diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ffc434..a900f11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -88,6 +88,33 @@ jobs:
       - name: Build the SPA and the SDK
         run: just web-build
       - run: just e2e
+      - run: just sim
+      - run: just smoke
+
+  # publish-canary needs this job, so its verdict decides whether a main commit is published:
+  # a moving tag here could pass a contract that did not hold. Pinned like the publishing job,
+  # for the same reason, even though this job itself holds nothing but a read token.
+  spec:
+    name: bounded contract checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: Install spec runner dependencies
+        run: sudo apt-get update && sudo apt-get install -y ripgrep
+      - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        with:
+          distribution: temurin
+          java-version: 21
+      - uses: taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2.87.4
+        with:
+          tool: just
+      - run: just spec
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always()
+        with:
+          name: spec-evidence
+          path: target/test-logs/spec-*
 
   # Canary image publish. Lives in this workflow, not a separate one, so `needs` gates it on the
   # same green run that just tested the commit: a red main never produces a canary tag, and there
@@ -101,7 +128,7 @@ jobs:
   # at a digest nobody chose. A re-run moves `canary` only; the sha- tag is written once, ever.
   publish-canary:
     name: publish canary image
-    needs: [build-test, e2e]
+    needs: [build-test, e2e, spec]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
diff --git a/AGENTS.md b/AGENTS.md
index a915676..8fc7d20 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,7 +11,7 @@ and the working rules (§5). Reading order starts at `GOAL.md`; §0 maps every o
 > because the bucket is the repository; everything else is disposable. If you find yourself writing "still
 > accepted for …" or "legacy", stop and remove the thing instead.
 
-walgit serves git over smart HTTP (v0/v2), receive-pack, upload-pack, bundle-uri, LFS and a browsing web UI,
+walgit serves git over smart HTTP (v0/v2), receive-pack, upload-pack, LFS and a browsing web UI,
 written in Rust, from disposable hosts whose only durable state is an object-store bucket. The reference workload
 it was built against is a 57 GiB / 73 M-object / 1.4 M-commit / 466 k-ref monorepo with LFS, served from
 machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositories. The design follows Cursor's
@@ -24,15 +24,16 @@ machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositor
 | `GOAL.md` | Everyone, first. What walgit is for, the acceptance table, what we do not optimise for. |
 | `AGENTS.md` (this) | Everyone. Constraints §1, WAL §2, principles §3, decisions §4, working rules §5. |
 | `README.md` | The introduction: why (the Cursor lineage), what it does, how it works briefly, running it, invariants. |
-| `docs/BUNDLE_URI_DESIGN.md` | Anyone touching bundles, the scheduler, base rebuilds, or big-repo clone/fetch UX. Design of record; normative config in §4. |
-| `docs/ROUNDTRIPS.md` | **Anyone touching a protocol that talks to the bucket** (publish, sync, checkpoints, compaction/leases, bundles, remote reader, store backends). Round trips are the cost model; correct is not sufficient. |
+| `docs/PACKFILE_URI_DESIGN.md` | Anyone implementing pack groups, proofs, lifecycle, or negotiated delivery. Design target; later layers require separate implementation and evidence. |
+| `docs/PACKFILE_MIGRATION.md` | Bundle removal, saved settings, writer cutover, clients and rollout gates. |
+| `docs/spec/README.md` | Bounded models, contract identifiers, result semantics, code/test map and remaining verification gaps. |
+| `docs/ROUNDTRIPS.md` | **Anyone touching a protocol that talks to the bucket** (publish, sync, checkpoints, compaction/leases, remote reader, store backends). Round trips are the cost model; correct is not sufficient. |
 | `docs/POLICY.md` | Anyone touching receive-pack authorization or writing a repo policy. Normative rule language. |
 | `docs/LFS.md` | Anyone touching LFS (`lfs.rs`, `lfs_upstream.rs`) or importing a repository whose LFS history lives elsewhere. |
 | `docs/INTEGRITY.md` | Anyone touching import, the maintainer's `fsck`/`repair` units, or seeing `connectivity: missing object` on a push. |
 | `docs/EVENTS.md` | Anyone changing WAL-derived ref events, the webhook bridge, consumer semantics or event cursors. |
 | `docs/CONTRACT.md` | When you touch a crate boundary. The cross-crate contract; *extend, don't rename*; code wins where they differ. |
 | `docs/reference/cursor-git-at-any-scale.md` | The source design, verbatim. Read once before touching WAL/publish/sync/placement. |
-| `docs/patches/README.md` | Git client patches (bundle filter matching) and the gate for advertising filtered bundle families together. |
 | `web/API.md` | UI/SDK authors and anyone changing `web/*.rs`. Wire contract, caching rules, SSE envelope, tasks, prefix-first lanes. |
 | `web/sdk/README.md` | Users of `repos.js`. |
 | `web/README.md` | Frontend engineers changing the React SPA, Vite build, SDK adapter, static assets, loading states. |
@@ -57,15 +58,14 @@ machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositor
   (`wal.prefetch_max_bytes`).
 - **Object store facts**: ~60–80 ms per GET, ~100 MB/s per connection (stripe for more), conditional GET ~15 ms;
   same-object overwrite is serialized (~1 write/s) — a single CAS'd object is a throughput cap.
-- Operations that need real disk or hours of CPU (a full `repack -adb` of a monorepo, building its 30 GB weekly
-  bundle) run on a host with an SSD using the same binary and the same WAL/lease protocol (`walgit compact
+- Operations that need real disk or hours of CPU (a full `repack -adb` of a monorepo) run on a host with an SSD using the same binary and the same WAL/lease protocol (`walgit compact
   --base`, `walgit import`, the `maintain` role with `maintenance.disk = "ssd"`).
 
 ### 1.2 What follows
 - **Never fully materialize a big repo on a small instance.** Serve from the parts that fit: refs from the WAL
   (ref snapshot + log tail), pack *indexes* + bitmaps + commit-graph locally, pack *data* by range read from the
-  bucket (remote reader) or a read-only bucket mount, recent small packs locally. Clone bytes come from static
-  bundles, never through upload-pack.
+  bucket (remote reader) or a read-only bucket mount, recent small packs locally. Negotiated reusable packs are the static delivery target; during the removal phase clone/fetch
+  use dynamic upload-pack, subject to the existing bounded serving/placement limits.
 - **An instance must become useful in seconds**, cold: refs in < 1 s (one manifest GET + snapshot + tail),
   objects for the web UI within the first request (remote reader), fetch remainders from local small packs.
 - **Everything an instance computes that is immutable is cached for everyone**: in-process LRU and, where a
@@ -99,13 +99,9 @@ machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositor
   exit 2 with the two things to do); writes `~/.config/git/<host>-token` (0600) and the credential helper
   `<host>-credential-helper` (`get` → `authtype=Bearer`; `store` keeps what git hands it; `erase` on a 401 deletes
   the token and names `/_auth/tokens`); sets exactly `credential.https://<host>.helper` = `""` then ours,
-  `transfer.bundleURI true`, `fetch.uriProtocols https`; unsets stale `fetch.bundleURI`/`extraHeader`; self-tests
+  `fetch.uriProtocols https`; self-tests
   (`/api/v1/me`, or `ls-remote` of `?repo=`). Recipes come from one place (`setup::Recipes`,
   `/services/setup.json`); the Clone menu, API page, overview and git error help render them.
-- **Bundle lists, two of them (D41)**: `bundles/list` is the *clone* list (fulls + chain; advertised in v2);
-  **`bundles/catchup`** is the same list without the fulls and is what every recipe records in `fetch.bundleURI`
-  — git's creationToken walk would otherwise download every full newer than the client's token.
-  Blobless: `…/list?filter=blob:none` / `…/catchup?filter=blob:none`.
 - **Host to host**: a front that forwards pushes to a broker presents `wal.push_broker_token` (or
   `WALGIT_BROKER_TOKEN`); the broker lists it in `tokens` and its principal in `trusted_forwarders`, so the end
   user travels in `X-Walgit-Principal`.
@@ -113,18 +109,16 @@ machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositor
 
 ### 1.4 Requirements (the bar)
 - Full git surface: smart HTTP v0/v2, ls-refs with prefixes, fetch with filter/shallow/deepen/sideband-all,
-  receive-pack (atomic, delete, tags, push options, report-status-v2), bundle-uri (v2 command + static list),
+  receive-pack (atomic, delete, tags, push options, report-status-v2),
   LFS batch/basic transfer, `<owner>/<repo>` namespaces. Every read on every instance is as fresh as a fetch:
   push acknowledged ⇒ the next request anywhere sees it.
 - Cost must not scale with ref count on any hot path (O(1) `refs`, O(k) `resolve`, paged ref lists, prefix
   filtered advertisements) nor with pack size on a too-small instance.
-- Clones of big repos are **static**: the server hands out URLs, the bucket/CDN moves the bytes. `bundles.require`
-  rejects clones that skip bundle-uri, with the exact fix in the error text.
+- Target: large clones negotiate proven reusable packs plus the uncovered graph. The removal phase keeps
+  ordinary dynamic transfer; it does not implement or certify this acceleration.
 - Acceptance for the monorepo: cold instance serves `info/refs`/ls-refs/web `refs` in < 1 s; web UI renders
-  main's tree/blob/commits without packs on disk; `git clone` (bundle-uri) + `git fetch` work against a tmpfs
+  main's tree/blob/commits without packs on disk; `git clone` + `git fetch` work against a tmpfs
   host; `clone --filter=blob:none --depth=1 --sparse --single-branch` in seconds (reference: 2075 s → 8 s).
-  Bounded/CI clones must pass `-c transfer.bundleURI=false`: git downloads the advertised full bundle first
-  otherwise (the server cannot see the filter at bundle-uri time).
 
 ---
 
@@ -137,8 +131,7 @@ machines whose "disk" is 20 GiB of tmpfs, next to a long tail of small repositor
 | `log/<first_seq>.pb` | Immutable, uvarint-framed `LogEntry` frames: PUSH / REF_UPDATE (ref transaction + pack pointer), COMPACT (new pack, `supersedes[]`), CHECKPOINT, SETTINGS. Strictly increasing `seq`. One small object per publish batch. |
 | `wal/<checksum>.pack/.idx/.rev/.bitmap/.commit-graph` | Immutable packs, content-addressed by pack checksum: push packs (tier 0), compaction outputs (tier 1), the base (tier 2, bitmap'd), plus the side-files a reader needs. |
 | `checkpoints/<seq>/checkpoint.pb`, `refs.pb` | Folded state at `seq`: live pack set + full `RefSnapshot`. Cold start = snapshot + tail, never full replay. |
-| `bundles/list.pb`, `bundles/<strategy>/…` | bundle-uri artefacts + CAS'd list. |
-| `leases/<name>.pb` | CAS lease with TTL heartbeat: `compact`, `bundle:<strategy>`. The only cross-instance mutex. |
+| `leases/<name>.pb` | CAS lease with TTL heartbeat: `compact`. The only cross-instance mutex. |
 | `cache/api/v1/<sha1>.json` | Shared render cache of immutable web API answers. |
 | `policy.json` | Per-repo push policy (rule language, not on the WAL). `docs/POLICY.md`. Missing = allow-all. |
 | `fsck.pb` | Last connectivity audit (`FsckReport`), written by the maintainer's `fsck` unit, consumed by `repair` (`docs/INTEGRITY.md`). |
@@ -165,13 +158,13 @@ same ingest → connectivity → fast-forward → `publish_push` path, `principa
 Every request: conditional GET of `manifest.pb` (skippable for `wal.freshness_ttl`) → 304 serve / 200 apply.
 | Level | Brings | Used by |
 |---|---|---|
-| **Refs** | checkpoint `RefSnapshot` + every log entry's ref txn → `packed-refs`. No packs. | `info/refs`, `ls-refs`, `bundle-uri`, web `refs`/`resolve`/overview, read_log |
-| **Serve** (`sync()`) | Refs + the pack set as the instance can hold it: tiers < 2 and the **history pack** (D18) local; a tier-2 base as side-files (idx/rev/bitmap/commit-graph layer) + `pack-<sha>.pack` linked into a read-only bucket mount (`cache.store_mount`) or **remote-served** without one; midx over history + base | upload-pack, receive-pack, bundle builds, prewarm |
+| **Refs** | checkpoint `RefSnapshot` + every log entry's ref txn → `packed-refs`. No packs. | `info/refs`, `ls-refs`, web `refs`/`resolve`/overview, read_log |
+| **Serve** (`sync()`) | Refs + the pack set as the instance can hold it: tiers < 2 and the **history pack** (D18) local; a tier-2 base as side-files (idx/rev/bitmap/commit-graph layer) + `pack-<sha>.pack` linked into a read-only bucket mount (`cache.store_mount`) or **remote-served** without one; midx over history + base | upload-pack, receive-pack, prewarm |
 | **Full** (`sync_full()`) | Refs + every live pack local (striped parallel range downloads); only for repos that fit | base rebuilds (`compact --base`), geometric compaction |
 | **Objects** | Serve when the pack set fits `cache.max_bytes`, else Refs + **remote reader** → `ObjectAccess::{Local,Remote}` | web API object endpoints |
 Long syncs register as tasks (`materialize`, `remote-index`) and stream progress; pack work runs on the **bulk
 runtime** and never takes the refs phase's lock (D19). `check_fits` refuses to pull a pack set that cannot fit
-(TooLarge → 503 / pkt ERR with the bundle-uri fix). Local disk is a bounded LRU (`cache.max_bytes`,
+(TooLarge → 503 / pkt ERR with a truthful resource/placement explanation). Local disk is a bounded LRU (`cache.max_bytes`,
 `evict_idle_after`) in budget mode, watermark eviction in disk mode (D25).
 
 ### 2.4 Getting the most out of the WAL (the strategies)
@@ -196,44 +189,41 @@ runtime** and never takes the refs phase's lock (D19). `check_fits` refuses to p
 - **Never LIST on a hot path**; 404s are free; probe, don't list. Immutable objects get
   `Cache-Control: public, max-age=31536000, immutable` + strong ETag + Range everywhere (D10 static contract).
 
-### 2.5 Compaction (WAL + git), leader by lease
-- Assigned maintainers run **geometric** folding of fresh packs (tier 0 → tier 1, `git repack -d --geometric
-  --write-midx`) under `leases/compact.pb`; the result is a COMPACT entry; followers download the new pack and
-  drop superseded ones after in-flight readers finish. Triggers: `compaction.trigger_packs`, `trigger_bytes` —
-  and at least **two** fresh packs (one pack folds into itself).
-- **The base (tier 2, one pack + bitmap) is rebuilt only when the weekly bundle is built, and only on an ssd
-  host** — the maintainer's `BaseRebuild` unit, followed by the weekly slot's compose
-  (`docs/BUNDLE_URI_DESIGN.md §5`; `walgit compact --base` is the manual form). The rebuild runs in a scratch copy
-  under `<cache.dir>/_rebuild/` that survives the process and resumes after a restart iff the WAL head has not
-  moved (§5a); the serving copy is never rewritten. Invariant that makes serving cheap: *everything newer than the
-  base lives in small/medium packs that fit on every instance.*
-- **A fold never touches the base or a history pack** (`--keep-pack`), **a base is rebuilt only by the weekly
-  unit / `compact --base`**, and **a rebuild supersedes every other live pack** by the manifest, not by what git
-  happened to delete.
-- Superseded packs are retained `compaction.retention_superseded` (provenance window) then GC'd.
+### 2.5 Pack lifecycle (WAL + git), leader by lease
+- Assigned maintainers classify committed packs, fold compatible fresh families geometrically, freeze
+  buffers by size or settlement, and re-segment by frozen-byte ratios under `leases/compact.pb`.
+  Classification and coverage repair do not rewrite ordinary scoped push packs. Folds incorporate only
+  geometrically comparable buffers; a large buffer does not move merely because enough tiny pushes arrived.
+- History/blob families and retained indexed objects share one ordinary ODB. Inputs are copied into an
+  isolated attempt under `<cache.dir>/_pack-lifecycle/`, with an owned reader pin and process lock.
+  Disk-backed inventories preserve indexed objects, including unreachable objects; Git recomputes deltas
+  from path-bearing object lists with explicit thread/window-memory limits. Full materialization and
+  input/output headroom are required, so large jobs need sufficient disk placement.
+- Plan/step receipts are disposable progress. Outputs publish additively; only the final seal retires
+  exact captured inputs, rechecking live descriptors and policy on each CAS attempt. An overlapping
+  output checksum stays live. Readers retain local files until their guards release. MIDX bitmaps over
+  the readable inventory are verified before use. `walgit compact --base` forces the same conserving cut.
+- Superseded pack records and bucket bytes remain indefinitely for issued downloads; there is no timed GC knob.
 
 ### 2.5b Self-healing by construction (D22)
-Everything the maintainer produces — checkpoints, bundles per slot, compactions, retention — is a **pure function
-of (config, WAL state)**. The maintainer does not run schedules; it computes the *desired state* every pass and
-performs **one bounded unit of the most important missing work** (checkpoint → repair → missing weekly → missing
-dailies oldest-first → missing hourlies → compaction → rev-index → fsck audit), as a task, under a lease. An outage
-of any length leaves no permanent hole; a deleted or corrupt artefact is "missing" and rebuilt identically; config
-changes take effect by re-planning; there are no one-off backfill scripts.
-
-### 2.6 Bundles (bundle-uri): move clone bytes to static files — **the north star** (`docs/BUNDLE_URI_DESIGN.md`)
-- Strategies (config, D21/D22): **weekly full** (for a big repo = base pack ∘ header via store-side compose — GCS
-  natively, S3 by multipart `UploadPartCopy`; no disk, no index-pack), **daily incremental** chained on the previous
-  daily, **hourly incremental** on the newest daily, each on a calendar slot (6-field UTC cron `schedule`; the fire
-  time is the as-of instant), `creationToken = slot epoch`, main-only refs for `bundles.main_only` repos;
-  `bundles/list.pb` CAS'd.
-- Served as static objects (`/{o}/{r}.git/bundles/...`, ETag/Range, immutable) by walgit or offloaded to an edge
-  (`X-Accel-Redirect`, `deploy/nginx.conf.example`), or as presigned store URLs (`serve_via = "signed_url"`);
-  advertised in the v2 capability list, at `bundles/list` and on band 2 of every narrated fetch. `bundles.require`
-  refuses *unbounded* zero-have fetches of listed repos with the exact fix (D17).
-- Builds run on the **maintainer** under `leases/bundle:<strategy>` (Serve sync first; unresolvable tips skipped
-  with a notice); weekly full is a compose.
-- **Blobless family** (design §6b): strategies with `filter = "blob:none"` — weekly-history = header ∘ the D18
-  history pack, incrementals `--filter=blob:none` — advertised ONLY at `bundles/list?filter=blob:none`.
+Everything the maintainer produces — checkpoints, compactions, integrity work and retention — derives from
+(config, WAL state). Each pass performs bounded useful work as a narrated task under the applicable lease.
+There are no bundle schedules or separate base-rebuild engine. Missing coverage requests proof repair,
+not a full cut; URI delivery remains a separately gated layer.
+
+### 2.6 Packfile delivery target (D42)
+
+[The packfile design](docs/PACKFILE_URI_DESIGN.md) replaces scheduled bundle wrappers with reusable ordinary
+packs selected during fetch. Exact current-policy group certificates and captured snapshots must prove every
+subtracted root, with complete same-generation dependencies and live checks on every CAS attempt. Metadata
+stays outside normal code delivery; retained indexed objects survive maintenance. Static URLs require read
+authorization plus exact live/retired membership. Retired downloads do not expire arbitrarily.
+
+The native v2 path delivers proven URI packs for anonymous-read clients; gix/remote engines stay dynamic.
+Protected clients retain dynamic fallback pending independent authenticated-client qualification. Discovery
+uses `refs.advertise`; v2 mirrors request `server-option=ref-view=all` for complete ordinary refs. Static pack
+and index GET/HEAD require read auth and fresh live/retired membership. Never subtract synthetic haves on a
+path that does not emit their URLs. See [migration gates](docs/PACKFILE_MIGRATION.md) before changing durable writers.
 
 ### 2.7 Tasks, progress, narration (`walgit-wal/src/tasks.rs`, `crates/walgit-server/src/sse.rs`, `smart.rs`)
 Any long work = a task: unique id, per-instance log (`GET …/tasks`), `(repo, kind)` lock (a second start joins),
@@ -254,7 +244,7 @@ decision in §4 — or the PR is; never "fix later".
 | # | Principle | The tell in a PR | The question to answer |
 |---|---|---|---|
 | **I** | **No state outside the object store.** Disk and memory are caches. | A database, Redis, SQLite, a file that must survive a restart, an env var that encodes data. | "If every instance is wiped now, what is lost?" — must be "warmth". |
-| **II** | **The manifest CAS is the only commit point.** Immutable objects are never overwritten (`PutMode::Overwrite` only on the manifest, bundle list, leases, fsck.pb, events/cursor, maintainer heartbeats, render cache). | A second "commit" (a flag file, a list update that makes data visible), an ACK before the bucket's. | "What does a client on another instance see between the PUT and the CAS?" — nothing new. |
+| **II** | **The manifest CAS is the only commit point.** Immutable objects are never overwritten (`PutMode::Overwrite` only on the manifest, leases, fsck.pb, events/cursor, maintainer heartbeats, render cache). | A second "commit" (a flag file, a list update that makes data visible), an ACK before the bucket's. | "What does a client on another instance see between the PUT and the CAS?" — nothing new. |
 | **III** | **Side effects are readers of the WAL, never steps of a write.** Events, mirrors, notifications tail the log from a durable cursor. | A webhook/HTTP call from `receive.rs`, `publish.rs`, `follow.rs`, `smart.rs`. | "If this side effect fails, does the push?" — no. "Is it replayable from the cursor?" — yes. |
 | **IV** | **Every read revalidates; there is no eventually.** | A cache that outlives the manifest's generation, a TTL invented for a repo-scoped answer, a read that skips `sync_*`. | "After `push` returns `ok`, can any instance serve the old state?" (`cargo test -p walgit-server --test sim`). |
 | **V** | **Serve from the parts that fit; never a bigger box, never a hard-coded host.** | "Just download the pack", a path that assumes the full pack set is local, a hostname in `crates/` or `web/`. | "What happens to this code on a 20 GiB tmpfs with a 32 GB base pack? Which sync level does it need?" |
@@ -266,7 +256,11 @@ decision in §4 — or the PR is; never "fix later".
 
 ---
 
-## 4. Decisions in force (append, never silently change)
+## 4. Decisions (append, never silently change)
+
+D42 supersedes every bundle-specific runtime statement below, including D2/D9/D11/D17/D19/D21/D22/D24/D26/D29/D41.
+Those statements are retained as decision history, not active configuration or implementation guidance.
+Unrelated constraints remain in force. The current design target and migration gates are linked in §0.
 - **D1** Rust, tokio + axum, HTTP/2 (h2c or ALPN), streaming both ways, gzip request bodies.
 - **D2** gix in-process where it is correct and measured; upstream `git` for delta-compressing repack/bitmaps,
   bundle creation, and normal upload-pack. **`git.upload_pack_engine = "auto"` selects stock git wherever it can
@@ -299,7 +293,7 @@ decision in §4 — or the PR is; never "fix later".
   `/{o}/{r}/api-browser/…`; `/api/v1` is non-repository discovery, identity and owner listing. No aliases.
 - **D16** Push authorization is a per-repo **rule language** at `repos/<o>/<r>/policy.json` (`docs/POLICY.md`).
   Envelope `version` + `groups` + `rules`; `protect` = AND. Empty/missing = anyone with write may move any ref.
-- **D17** `bundles.require` refuses only **unbounded** zero-have fetches (no `deepen*`, no `filter`): that is a
+- **D17 (historical; superseded by D42)** `bundles.require` refuses only **unbounded** zero-have fetches (no `deepen*`, no `filter`): that is a
   full clone and belongs to bundle-uri. Bounded zero-have fetches (CI's `--depth`/`--filter`) go to upload-pack.
   git never retries a failed bundle download and then falls back to a zero-have fetch; a principal that fetched
   the repo's `bundles/list` within the hour gets **one upload-pack full clone per 6 h** with a loud band-2
@@ -319,15 +313,15 @@ decision in §4 — or the PR is; never "fix later".
   (`web/sdk/repos.ts`; IIFE registers `window.repos`, ESM `repos.mjs`) maps the whole surface, picks the lane,
   does the popup dance and unwraps the SSE envelope; served at `/repos.js` (open, so a `<script>` tag can load it).
   **Dogfood rule**: the bundled UI is built on the SDK (`web/src/api.ts` is an adapter); fix the SDK, never fork.
-- **D21** **No monthly bundle layer.** git's `creationToken` heuristic never walks past a full bundle; two layers
+- **D21 (historical; superseded by D42)** **No monthly bundle layer.** git's `creationToken` heuristic never walks past a full bundle; two layers
   of incrementals (daily, hourly) under one full (weekly) is the shape. Incrementals without `chain` list only
   their 2 newest per strategy (the second so a client that read the list a slot ago never 404s mid-chain);
   **`chain = true`** cuts a slot on the strategy's own previous bundle while that is newer than the newest base
   bundle — every slot since the base is wanted and kept, each exactly its delta. **Dailies are chained by
   default**; hourlies stay on the newest daily with 2 kept. `slots::base_for_incremental` is the one place that
   knows either rule.
-- **D22** **Bundles are cut on calendar slots, main-only, as-of-slot, with a contiguous chain**
-  (`docs/BUNDLE_URI_DESIGN.md` §3/§4): a 6-field UTC cron `schedule` whose fire time *is* the slot; missing full
+- **D22 (historical; superseded by D42)** **Bundles are cut on calendar slots, main-only, as-of-slot, with a contiguous chain**
+  (the former bundle design): a 6-field UTC cron `schedule` whose fire time *is* the slot; missing full
   slots backfilled oldest-first (`backfill_max`); content is main as of the highest WAL seq with `created_at ≤
   slot`; `creationToken = slot epoch`; prerequisites = tips of the newest `base` bundle at or before the slot;
   retention = `keep` fulls + the chain under them; refs default to `HEAD` + `refs/heads/main` for
@@ -392,7 +386,7 @@ decision in §4 — or the PR is; never "fix later".
   `X-Walgit-Capabilities`** — never assumed. (3) `cache.dir` defaults to `/tmp/walgit`. (4) A missing `--config`
   file is fatal (exit 2); `--config /dev/null` is the explicit defaults+env form. (5) The credential helper and
   token file are host-derived (`<host>-credential-helper`, `<host>-token`) so two walgit hosts coexist on one machine.
-- **D41** **Bundles: chained dailies, a clone list and a catch-up list, the chain through the weekly.** Dailies
+- **D41 (historical; superseded by D42)** **Bundles: chained dailies, a clone list and a catch-up list, the chain through the weekly.** Dailies
   are cut on their predecessor (`chain = true`, default), hourlies on the newest daily (2 kept); at the tie between
   Sunday's daily and the weekly the chain continues through its own link, so Monday's daily has the weekly's tips
   as prerequisites without being cut on it; retention keeps the chain under every kept full. `bundles/list` (fulls
@@ -400,10 +394,99 @@ decision in §4 — or the PR is; never "fix later".
   catch-up is exactly the slots missed; for a client fetching several times a day, upload-pack's thin pack is
   smaller than an hourly bundle — bundles pay off for fresh clones and far-behind clients.
 
+- **D42 (2026-09-11): Replace bundle runtime with negotiated reusable packs, in reviewed stages.**
+  Migration: remove bundle crate/command/routes/protocol/schedules/config/cache/recipes now;
+  ordinary dynamic clone/fetch remain. [PACKFILE_URI_DESIGN.md](docs/PACKFILE_URI_DESIGN.md) is the replacement
+  target, not a claim that its later layers are wired. Independent code/meta groups, conserving history/blob
+  lifecycle, exact captured coverage/dependencies, CAS revalidation and authenticated live/retired membership
+  gate static emission. Retired URI records/bytes have no time or count cap. All engines must either deliver
+  selected URLs or avoid synthetic subtraction. Protected stock clients retain dynamic fallback until a
+  distributable authenticated client is independently verified. Durable protobuf numbers/messages remain
+  append-only/replayable; old bundle runtime objects are not read/written. Host config and new settings reject
+  obsolete bundle keys. A durable-only settings transition may explicitly remove the obsolete bundle table,
+  warn and preserve supported overrides/raw history; it must never invent a wider ref/packing policy.
+  [PACKFILE_MIGRATION.md](docs/PACKFILE_MIGRATION.md) defines compatible-writer rollout and evidence gates;
+  no bucket deletion is part of this change. D42 overrides bundle-specific parts of earlier decisions only.
+
+- **D43 (2026-09-11): Coverage and retirement authority lives in the manifest.** Named packing groups and
+  advertisement selectors are independent policies; group kinds grant no access. Canonical content-addressed
+  ref snapshots bind certificates to an exact captured generation. Every classification/compaction CAS checks
+  current policy, live members and same-generation dependencies; stale certificates lose eligibility without
+  deleting their objects. Retired checksums remain recorded indefinitely. Checkpoint metadata uses unique
+  attempt keys and commits the exact refs key; old checkpoints resolve their original committed descriptor.
+  Producers capture manifest, CAS token, refs and validated settings coherently. Invalid saved packing policy
+  fails coverage capture instead of substituting host defaults. Stop incompatible writers before the new
+  writer runs: older binaries do not enforce format-version fencing. This foundation alone does not emit URLs
+  or prove object conservation; those require the lifecycle and transport layers described in D42.
+
+- **D44 (2026-09-11): One pack lifecycle configuration replaces compaction knobs.** `[packs]` owns
+  geometric factor/count/proportional bytes/age, minimum two fold inputs, size/settlement freeze, frozen-share
+  and re-segmentation ratios, target segment size, and bounded delta-search resources. The default 2 GiB is
+  a Git target, not an absolute bound on an oversized object. Resolve an explicit CPU-bounded thread count
+  and divide the host-clamped whole-operation window-memory budget before invoking Git. Native Git is the
+  only producer, so there is no engine selector. GNU sort/comm are runtime dependencies. Classification and
+  proof repair stay separate from expensive re-segmentation; a missing certificate does not justify a cut.
+  Host/new settings reject `[compaction]`. Saved bucket records alone may map enabled/factor/count/lease
+  fields and omit the old Git-only engine; any saved flat trigger or retention timeout disables pack work
+  with an explicit warning until an administrator rewrites settings. Conflicting old/new sections fail;
+  other overrides and raw history survive. Ordinary serving remains available. This supersedes older
+  compaction-configuration and timed pack-retention guidance, while lifecycle and URI evidence gates in
+  D42/D43 remain required. [Migration details](docs/PACKFILE_MIGRATION.md).
+
+- **D45 (2026-09-12): Conserving maintenance uses one staged lifecycle.** The current §2.5
+  supersedes the single-base rebuild and separate geometric producer descriptions in D18/D31.
+  Existing derived history packs remain readable durable data. New grouped history is authoritative,
+  not a disposable accelerator. Preserve the full indexed input set through retained families,
+  commit outputs additively, and retire exact inputs only at the final manifest CAS. Verify local
+  MIDX/bitmap identity and traversal; remote engines retain ordinary traversal when pack bytes are
+  absent. Shared code/meta objects may occupy one physical checksum with both memberships; code
+  eligibility still requires exact code-group proof. Scratch receipts and locks cannot establish
+  durable authority. This layer does not certify negotiated delivery, protected clients, model
+  refinement, or large-repository resource/performance acceptance.
+
+- **D46 (2026-09-12): Native URI delivery and discovery have separate gates.** Normal discovery uses
+  `refs.advertise`; explicit v2 `ref-view=all` preserves mirror/backup access to ordinary auxiliary refs.
+  Receive-pack remains complete. Only native Git may subtract selected roots; gix and remote dispatch happen
+  first and remain dynamic. Selection uses exact captured certificates and one shared three-snapshot budget;
+  size/count limits cannot discard required companions. URI encoding is non-thin. Static pack/index routes
+  revalidate live/retired membership after ordinary read auth, and protected responses use private caching.
+  `packfile-indexes` is an explicit optional wire extension, not proof of authenticated-client compatibility.
+  Protected dynamic fallback remains until a distributable client is qualified. No version-label heuristic,
+  anonymous exposure of protected packs, `.rev` transfer, arbitrary-want coverage guess or full-clone refusal
+  knob is introduced. Large narrated dynamic clones warn. Scale and model/code mapping gates remain open.
+
 Decision identifiers are stable; gaps in the numbering are intentional.
 
+- **D47 (2026-09-12): Publication evidence and receipts are exact.** A no-op ref submission with no
+  new pack reports success at seq 0 without creating history; an empty-ref pack-only push rejects. A
+  rejected submission reports rejection for every command. Each immutable log claim carries a fresh
+  reserved `walgit.publication_nonce`; exact bytes, not key/sequence alone, resolve a lost CAS reply.
+  Missing evidence stays `CommitUnknown`. Buffered forwarding falls back only before delivery;
+  ambiguous transport and gateway replies never trigger local replay. Disable broker redirects and
+  automatic transport retries. Bounded models and their precise controls run in CI; the
+  [code/test map](docs/spec/README.md) records unproved boundaries and remaining corrections.
+
 ---
 
+- **D48 (2026-09-12): Cache evidence and readiness.**
+
+Remote index admission verifies index checksum, pack checksum identity and known descriptor size/count,
+including reused installed links. Repair installs a fresh inode. A repository-local kernel lock protects
+cache names across processes until callers own opened mappings or independent links; blocking workers keep
+the lock through cancellation. Temporary names belong to one attempt, and abandoned names are reclaimed
+only while holding the lock. This local ownership is disposable cache coordination, never publication
+truth. Carry pack readiness only from a proven matching inventory; inherited nonempty caches reconcile on
+open, including manifest changes that advance revision without adding a log entry. Small downloads reject
+short or oversized bodies. These checks do not replace the required per-CAS closure proof or establish the
+full cold-read/resource acceptance gates listed in `docs/spec/README.md`.
+
+- **D49 (2026-09-12): Final retirement re-proves indexed conservation.** Capture manifest/token/refs
+  together on every seal attempt, verify the exact current indexes, and merge input/output OID streams
+  with one cursor per pack. Every indexed input object must survive in the declared outputs, and every
+  current tip must appear in the resulting live inventory before the log claim/CAS. Raw producer admission
+  and candidate external-boundary proof remain separate obligations; local loose objects and retired
+  download membership cannot justify retirement. See the cost and remaining-evidence rows in the linked docs.
+
 ## 5. Working rules
 
 - **No backwards compatibility (pre-1.0, banner at top):** change the shape and delete the old one in the same
@@ -417,7 +500,7 @@ Decision identifiers are stable; gaps in the numbering are intentional.
   stalled" with `inflight` and `tasks_running`: `inflight = 0` at a late tick ⇒ the platform paused the process,
   `inflight > 0` ⇒ a real stall — look at `lock_wait_max_ms` and `walgit_lock_wait_seconds{lock}`. Bulk bytes never
   share a transport with the control plane (`store.gcs.bulk_clients`, `bulk_concurrency`).
-- **Correct is not sufficient.** Every protocol change (publish, sync, leases, checkpoints, bundles) is also
+- **Correct is not sufficient.** Every protocol change (publish, sync, leases, checkpoints, pack delivery) is also
   judged on critical-path round trips against the bucket — read `docs/ROUNDTRIPS.md`, update its budget table, put
   before/after depth in the commit, keep verification on the failure path, assert request budgets in the sim.
 - **Standalone first (D39):** a feature must work with walgit hit directly (no edge, in-process TLS, bytes
@@ -425,8 +508,8 @@ Decision identifiers are stable; gaps in the numbering are intentional.
   infer an edge from config, never hardcode a hostname in `crates/` or `web/`.
 - **S3 and GCS are both first class.** Every store feature has both implementations and runs in the contract
   suite (`just test-s3` against rustfs, `just test-gcs <bucket>`); "GCS only" is a bug.
-- **Use the rig before prod** (`just dev-store` → `walgit-server --config walgit.standalone.toml`). Per-repo
-  settings (D24) with minute-scale slots compress a week of bundle behaviour into 30 minutes.
+- **Use the rig before prod** (`just dev-store` → `walgit-server --config walgit.standalone.toml`). Exercise
+  ordinary clone/fetch and bounded maintenance against the rig before testing on large repositories.
 - No new auth paths (§1.3). No LIST on hot paths. No unbounded buffering of packs in memory. No full
   materialization above `cache.max_bytes` in budget mode. No silent long operations (make it a task, narrate it).
 - Every immutable response: `immutable` + strong ETag + Range; every ref-dependent response: SWR + ETag.
@@ -435,7 +518,7 @@ Decision identifiers are stable; gaps in the numbering are intentional.
 - Web: pnpm + Vite, `pnpm run build` must pass oxlint/tsc. Config: `walgit.example.toml` documents every key;
   change it with the code.
 - Test tiers: `just test` (fast, < 1 min), `just e2e`, `just warnings`, `just clippy` (the
-  `[workspace.lints]` set, `-D warnings`), `just ci` = all four; the **simulation
+  `[workspace.lints]` set, `-D warnings`), `just ci` = all four plus `just sim` and `just smoke`; the **simulation
   suite** `cargo test -p walgit-server --test sim` (fault links per instance over one truth store: crash,
   partition, stale, lost response, orphan scenarios + randomized seeds `WALGIT_SIM_SEEDS`/`WALGIT_SIM_SEED`);
   `just test-slow` (ignored benches); `tests/e2e.sh` against a running server (`WALGIT_E2E_BASE_URL`,
diff --git a/Cargo.lock b/Cargo.lock
index ea4b7aa..5d53ed2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1146,17 +1146,6 @@ dependencies = [
  "cfg-if",
 ]
 
-[[package]]
-name = "cron"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5877d3fbf742507b66bc2a1945106bd30dd8504019d596901ddd012a4dd01740"
-dependencies = [
- "chrono",
- "once_cell",
- "winnow 0.6.26",
-]
-
 [[package]]
 name = "crossbeam-channel"
 version = "0.5.16"
@@ -5780,32 +5769,6 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
 
-[[package]]
-name = "walgit-bundle"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "bytes",
- "chrono",
- "cron",
- "futures",
- "hex",
- "metrics",
- "parking_lot",
- "prost",
- "sha1 0.10.7",
- "tempfile",
- "thiserror",
- "tokio",
- "tracing",
- "walgit-config",
- "walgit-git",
- "walgit-proto",
- "walgit-store",
- "walgit-wal",
-]
-
 [[package]]
 name = "walgit-cli"
 version = "0.1.0"
@@ -5833,7 +5796,6 @@ dependencies = [
  "toml",
  "tracing",
  "tracing-subscriber",
- "walgit-bundle",
  "walgit-config",
  "walgit-git",
  "walgit-proto",
@@ -5848,9 +5810,10 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "bytesize",
- "cron",
+ "hex",
  "humantime-serde",
  "serde",
+ "sha2 0.10.9",
  "toml",
  "tracing",
 ]
@@ -5898,10 +5861,13 @@ dependencies = [
 name = "walgit-proto"
 version = "0.1.0"
 dependencies = [
+ "anyhow",
  "bytes",
+ "hex",
  "prost",
  "prost-build",
  "prost-types",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -5961,7 +5927,6 @@ dependencies = [
  "tracing",
  "tracing-subscriber",
  "uuid",
- "walgit-bundle",
  "walgit-config",
  "walgit-git",
  "walgit-proto",
@@ -6033,6 +5998,7 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tokio-util",
+ "toml",
  "tracing",
  "uuid",
  "walgit-config",
@@ -6377,15 +6343,6 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
-[[package]]
-name = "winnow"
-version = "0.6.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e90edd2ac1aa278a5c4599b1d89cf03074b610800f866d4026dc199d7929a28"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "winnow"
 version = "0.7.15"
diff --git a/Cargo.toml b/Cargo.toml
index 97c9340..2a1c3be 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -7,7 +7,6 @@ members = [
     "crates/walgit-git",
     "crates/walgit-wal",
     "crates/walgit-server",
-    "crates/walgit-bundle",
     "crates/walgit-cli",
 ]
 
@@ -67,7 +66,6 @@ walgit-config = { path = "crates/walgit-config" }
 walgit-git = { path = "crates/walgit-git" }
 walgit-wal = { path = "crates/walgit-wal" }
 walgit-server = { path = "crates/walgit-server" }
-walgit-bundle = { path = "crates/walgit-bundle" }
 
 anyhow = "1"
 thiserror = "2"
@@ -131,7 +129,6 @@ hex = "0.4"
 humantime = "2"
 humantime-serde = "1"
 bytesize = { version = "2", features = ["serde"] }
-cron = "0.15"
 chrono = { version = "0.4", features = ["serde"] }
 uuid = { version = "1", features = ["v4"] }
 dashmap = "6"
diff --git a/Containerfile b/Containerfile
index 09d8ada..806d8ac 100644
--- a/Containerfile
+++ b/Containerfile
@@ -7,8 +7,8 @@
 #       -v walgit-cache:/var/lib/walgit \
 #       walgit
 #
-# The image carries git (upload-pack, repack, bundle, index-pack run as subprocesses),
-# git-lfs, CA certificates and tini. Config comes from /etc/walgit/walgit.toml or
+# The image carries git (upload-pack, repack, index-pack run as subprocesses),
+# git-lfs, GNU coreutils (bounded sort/comm), CA certificates and tini. Config comes from /etc/walgit/walgit.toml or
 # WALGIT__SECTION__KEY environment overrides; the local cache (materialized repositories,
 # a self-signed TLS cert) lives under /var/lib/walgit and can be wiped at any time — the
 # bucket is the only durable state. `nix build .#image` produces the same thing from flake.nix.
@@ -42,10 +42,10 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     && install -D target/release/walgit-server /out/bin/walgit-server
 
 # ---- 3. runtime -----------------------------------------------------------------------------
-# trixie ships git 2.47+: walgit wants >= 2.47 on the server (pack.writeReverseIndex, bundle-uri,
+# trixie ships git 2.47+: walgit wants >= 2.47 on the server (pack.writeReverseIndex,
 # `index-pack --rev-index`); clients need >= 2.46.
 FROM docker.io/library/debian:trixie-slim
-RUN apt-get update && apt-get install -y --no-install-recommends git git-lfs ca-certificates tini curl \
+RUN apt-get update && apt-get install -y --no-install-recommends git git-lfs coreutils ca-certificates tini curl \
     && rm -rf /var/lib/apt/lists/* \
     && git --version
 RUN useradd --uid 1000 --create-home --shell /bin/sh walgit \
diff --git a/GOAL.md b/GOAL.md
index 0f571db..7290d2c 100644
--- a/GOAL.md
+++ b/GOAL.md
@@ -23,11 +23,12 @@ anyone can run against a bucket, and predictable enough that tooling can build o
 3. **Fast for the monorepo, from machines smaller than it.** A repository of tens of gigabytes, tens of
    millions of objects and hundreds of thousands of refs must be *fast* from a host with a few GiB of tmpfs:
    refs in < 1 s cold, web pages in ~100 ms, CI's `clone --filter=blob:none --depth=1 --sparse --single-branch`
-   in seconds, a developer's `git fetch` in the time it takes to read the output, fresh clones as static
-   bundles (weekly full + daily/hourly chain) so bytes move bucket → laptop and never through a server.
-   **Fast clone + fast catch-up through bundles is the north star** (`docs/BUNDLE_URI_DESIGN.md`).
+   in seconds, a developer's `git fetch` in the time it takes to read the output, fresh clones and stale fetches using negotiated reusable packs so bulk bytes can move directly to clients.
+   **Fast clone and catch-up through proved static packs is the north star**
+   ([design and current scope](docs/PACKFILE_URI_DESIGN.md)). Native anonymous-read delivery is implemented;
+   protected-client qualification and scale acceptance remain to be established and measured.
 4. **All the features a git host needs, and only those**: smart HTTP v0/v2 (ls-refs, fetch with
-   filter/shallow/deepen, receive-pack atomic/delete/tags/push-options/report-status-v2), bundle-uri, LFS,
+   filter/shallow/deepen, receive-pack atomic/delete/tags/push-options/report-status-v2), negotiated packfile delivery, LFS,
    `<owner>/<repo>` namespaces, per-repo push policy and settings, ref events, a browsing web UI + one JSON API +
    one SDK (`repos.js`), tasks/narration so nothing ever waits silently. Not in scope: code review, merge
    queues, CI, issues — those live elsewhere and build on this.
@@ -35,9 +36,9 @@ anyone can run against a bucket, and predictable enough that tooling can build o
    provider, a token for git), one install script, `git` does the rest; errors tell you the fix; every long
    wait is narrated. The developer on a rebased branch must get *cheaper*, never slower.
 6. **Predictable for the systems that build on it**: stable, immutable, cacheable, CDN-able artefacts
-   (bundles, packs, sha-addressed API answers); O(1) ref lookups; latency that does not depend on which
+   (packs, sha-addressed API answers); O(1) ref lookups; latency that does not depend on which
    instance you hit or how many refs exist; a provenance log you can rewind (`walgit wal materialize --at-seq`).
-7. **Use the tools; don't reinvent them.** Upstream `git` where it is right (repack, bitmaps, bundle create,
+7. **Use the tools; don't reinvent them.** Upstream `git` where it is right (repack, bitmaps,
    upload-pack), `gix` where it is faster and measured, Rust + tokio + axum for the server, the object store
    as it is (range reads, compose / multipart copy, CAS), a plain nginx or CDN in front of static bytes,
    content addressing everywhere, the WAL's ergonomics (`walgit wal ls|show|materialize`) as a first-class
@@ -50,8 +51,8 @@ anyone can run against a bucket, and predictable enough that tooling can build o
 |---|---|
 | Cold instance is useful in seconds | `ls-remote` of the largest repository < 1 s on a fresh instance, even while it installs that repository's packs |
 | CI clone of the monorepo | `clone --filter=blob:none --depth=1 --sparse --single-branch` in seconds, not minutes (reference: 2075 s → 8 s on a 57 GiB / 73 M-object repository) |
-| Developer catch-up | a days-stale `fetch` on main = exactly the bundle slots missed + < 1 h of objects from upload-pack |
-| Fresh clone of the monorepo | bytes through the server ≈ one hour of pushes; the rest is static bundles (reference: 32.7 GB static, 2.8 MB through upload-pack) |
+| Developer catch-up (target) | a stale `fetch` negotiates useful proven packs plus its uncovered requested graph; small fetches stay dynamic |
+| Fresh clone of the monorepo (target) | reusable packs carry the proven baseline; validate URI packs + dynamic remainder against ordinary Git and measure both server and client cost |
 | Web UI on the monorepo | tree/blob/commits without packs on disk, ~100–200 ms warm |
 | Push | acknowledged only after the bucket ACKs; one CAS per batch; the host that maintains a repository writes it |
 | Consistency | push then fetch anywhere sees it; concurrent pushers: exactly one winner (the simulation suite) |
@@ -61,5 +62,5 @@ anyone can run against a bucket, and predictable enough that tooling can build o
 ## What we deliberately do **not** optimise for
 
 - Millions of tiny repositories (the long tail is served, not tuned for).
-- Running a 30 GB base repack on a tmpfs host (that is a job for the host with the SSD, weekly).
+- Running a 30 GB base repack on a tmpfs host (that is a job for the host with sufficient disk).
 - Forking git or inventing an object format: weird stuff happens *around* git, never inside it.
diff --git a/README.md b/README.md
index 1cadc51..2c38632 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,7 @@
 # walgit — a git server that is one binary in front of an object store
 
 walgit hosts git repositories with **no database, no leader and no local state that matters**. You run a
-single binary, point it at an S3 or GCS bucket, and you have: smart HTTP (v0/v2) fetch and push, `bundle-uri`
-clones served as static files, Git LFS, a browsing web UI, a JSON API with an SDK, per-repository push policy,
+single binary, point it at an S3 or GCS bucket, and you have: smart HTTP (v0/v2) fetch and push, Git LFS, a browsing web UI, a JSON API with an SDK, per-repository push policy,
 webhooks — and a server that scales to repositories **larger than the machine it runs on**. Every machine that
 runs walgit is a disposable cache; the bucket is the repository.
 
@@ -63,21 +62,25 @@ WAL is the truth, there is complete provenance: every push and every repack, rep
 
 walgit takes that as-is, and adds what a *monorepo on small machines* needs: serving refs and web pages for a
 repository whose packs will never fit on the instance (a **remote reader** over HTTP range requests), keeping
-commits and trees local while blobs stay in the bucket (the **history pack**), and moving clone bytes out of the
-server entirely (**bundle-uri**: fresh clones and catch-ups are static files the bucket or a CDN hands out).
+commits and trees local while blobs stay in the bucket (the **history pack**).
+
+**Packfile migration:** bundle runtime has been removed. Native Git can deliver proven reusable packs plus
+the uncovered graph for anonymous-read repositories. Protected repositories and remote/gix serving use
+dynamic upload-pack; protected URI clients and large-repository performance remain release gates.
+Read the [design](docs/PACKFILE_URI_DESIGN.md) and
+[migration guide](docs/PACKFILE_MIGRATION.md), especially saved settings and existing client catch-up config.
 
 ## What it does
 
 | | |
 |---|---|
-| **git** | smart HTTP v0/v2: `ls-refs` with prefixes, fetch with filter/shallow/deepen/sideband-all, receive-pack (atomic, deletes, tags, push options, report-status-v2), `<owner>/<repo>` namespaces, sha1 and sha256 repositories. Upstream `git` does upload-pack/repack/bundle; walgit does receive-pack, the WAL and the plumbing. |
-| **bundle-uri** | Bundles cut on calendar slots (weekly full, chained dailies, hourlies) as a pure function of the WAL: a fresh clone downloads the newest full plus the chain above it from the bucket and asks the server only for the remainder; a catch-up downloads exactly the slots it missed. Two lists per repo: `bundles/list` for clones, `bundles/catchup` for fetches. Blobless families for `--filter=blob:none`. |
+| **git** | smart HTTP v0/v2: `ls-refs` with prefixes, fetch with filter/shallow/deepen/sideband-all, receive-pack (atomic, deletes, tags, push options, report-status-v2), `<owner>/<repo>` namespaces, sha1 and sha256 repositories. Upstream `git` does upload-pack/repack; walgit does receive-pack, the WAL and the plumbing. |
 | **LFS** | Batch API + basic transfer, objects in the bucket, optional read-through from an upstream LFS server for imported repositories. |
 | **web UI + API** | A React UI (tree, blob, commits, diffs, the WAL's own health page) on a read-mostly JSON API under `/{owner}/{repo}/api/*`; sha-addressed answers are immutable and cached everywhere; long answers stream progress as SSE. `repos.js` is a dependency-free SDK for pages, agents and scripts. |
 | **policy** | Per-repository push rules (`policy.json`): protected refs, groups, fast-forward only, bypass lists. `docs/POLICY.md`. |
-| **settings** | Per-repository config (bundle schedules, compaction, upstream follow) published into the WAL with history. |
+| **settings** | Per-repository config (maintenance, compaction, upstream follow) published into the WAL with history. |
 | **events** | A small bridge tails the WAL and POSTs ref events to a webhook, exactly-once per (repo, seq, ref) with a durable cursor. `docs/EVENTS.md`. |
-| **maintenance** | Checkpoints, bundle builds, geometric compaction, base rebuilds, connectivity audits and repairs — one loop that computes the desired state from (config, WAL) every pass and does one bounded unit of the most important missing work. Self-healing by construction: an outage leaves no holes; a deleted artefact is "missing" and rebuilt identically. |
+| **maintenance** | Checkpoints, geometric compaction, connectivity audits and repairs — one loop that computes the desired state from (config, WAL) every pass and does one bounded unit of the most important missing work. Manual `compact --base` rebuilds the base on a host with sufficient disk. |
 | **auth** | `none` (loopback), `token` (static tokens), `oidc` (any OpenID Connect issuer: browser sign-in, ID tokens, and walgit-issued access tokens for git). `/services/public/install.sh` sets a developer's machine up in one idempotent command. |
 | **stores** | S3 and S3-compatible (AWS, MinIO, rustfs, R2, Ceph, …) and GCS, first class; an in-memory store for tests. |
 
@@ -87,7 +90,7 @@ server entirely (**bundle-uri**: fresh clones and catch-ups are static files the
 head sequence, the live pack set, checkpoint pointer, settings — *the linearization point*), `log/<seq>.pb`
 (immutable entries: PUSH, COMPACT, CHECKPOINT, SETTINGS), `wal/<checksum>.pack|.idx|.rev|.bitmap|.commit-graph`
 (immutable, content-addressed packs with their side-files), `checkpoints/<seq>/` (folded ref snapshot + pack
-inventory so a cold start is snapshot + tail), `bundles/`, `leases/` (CAS with TTL — the only cross-instance
+inventory so a cold start is snapshot + tail), `leases/` (CAS with TTL — the only cross-instance
 mutex), `policy.json`, `lfs/objects/`, `events/cursor.json`.
 
 **A push**: our receive-pack indexes the pack (`git index-pack --fix-thin --rev-index` in a scratch dir), checks
@@ -97,7 +100,7 @@ committed into one CAS. The client sees `ok` only after the bucket does.
 
 **A read**: one conditional GET of the manifest; 304 → serve from the local copy, 200 → apply the new entries.
 What "apply" means depends on what the request needs: **refs** (snapshot + log → `packed-refs`, no packs:
-advertisements, the API, bundle lists), **serve** (the pack set *as this machine can hold it*: small packs and the
+advertisements, the API), **serve** (the pack set *as this machine can hold it*: small packs and the
 history pack local, a too-large base read by range), **full** (everything local, for repacks), **objects** (the
 remote reader, for the UI on a repository that does not fit). Pack downloads run on their own runtime and never
 block a refs request.
@@ -130,10 +133,10 @@ open https://walgit.localhost:8080/
 * `Containerfile`, `flake.nix` — an OCI image and a Nix package/devshell. Every green push to `main` publishes
   that image to `ghcr.io/<owner>/walgit` as `canary` (moving) and `sha-<40>` (immutable: what a rollback pins to).
 * `deploy/nginx.conf.example` — an optional nginx in front: public TLS, one `auth_request` per credential, and
-  **byte offload**: walgit answers bundle/LFS downloads with `X-Accel-Redirect` and nginx streams + caches the
+  **byte offload**: walgit answers LFS downloads with `X-Accel-Redirect` and nginx streams + caches the
   object from the bucket itself (S3 presigned or GCS with walgit's bearer). The file documents the contract.
 
-Roles (`server.roles`): `serve` (git, API, UI, bundles, LFS), `maintain` (checkpoints, bundles, compaction,
+Roles (`server.roles`): `serve` (git, API, UI, LFS), `maintain` (checkpoints, compaction,
 fsck/repair), `events` (the webhook bridge). Empty = all. Any number of `serve` hosts may point at one bucket; give
 each repository one maintainer (placement globs) and you are done.
 
@@ -148,7 +151,7 @@ each repository one maintainer (placement globs) and you are done.
 Developer setup is one idempotent command — `sh -c "$(curl -fsSL 'https://git.example.com/services/public/install.sh')"` —
 which stores the token in a file only the user can read, installs a tiny git credential helper (git ≥ 2.46: it
 answers `get` with `authtype=Bearer`, and on a real 401 `erase`s the token and says where a new one comes from),
-and turns on `transfer.bundleURI`. `?repo=owner/name` clones right after.
+and configures HTTPS URI negotiation. `?repo=owner/name` clones right after.
 
 ### Developing
 
@@ -170,20 +173,19 @@ crates/
   walgit-store    ObjectStore trait (CAS versions, conditional GET, range, compose); backends s3, gcs, memory; leases
   walgit-git      bare repos on disk, receive-pack, pack ingest, refs ↔ packed-refs, advertisements, upload-pack drivers
   walgit-wal      RepoHandle: sync levels, publish (group commit + CAS), checkpoints, log reader, remote reader, tasks
-  walgit-bundle   bundle-uri: slots and chains, building, header ∘ pack composition, lists, retention
-  walgit-server   axum: smart HTTP, LFS, bundles, auth (none/token/oidc), the maintainer loop, upstream follow,
+  walgit-server   axum: smart HTTP, LFS, auth (none/token/oidc), the maintainer loop, upstream follow,
                   web/ (API, UI, SDK routes, SSE), setup.rs (installer + recipes), events bridge
   walgit-config   walgit.toml (+ WALGIT__ env overrides), per-repo settings merge, fail-closed validation
-  walgit-cli      `walgit serve|import|compact|bundle|wal|mirror|synth|config|repo`; `walgit-server` = `walgit serve`
+  walgit-cli      `walgit serve|import|compact|wal|mirror|synth|config|repo`; `walgit-server` = `walgit serve`
 web/              React SPA (Vite) + sdk/repos.ts, built into the binary; the wire contract is web/API.md
-docs/             BUNDLE_URI_DESIGN, ROUNDTRIPS (the cost model), POLICY, LFS, INTEGRITY, EVENTS, CONTRACT, patches/
+docs/             PACKFILE_URI_DESIGN (target), PACKFILE_MIGRATION, ROUNDTRIPS (the cost model), POLICY, LFS, INTEGRITY, EVENTS, CONTRACT
 ```
 
 ## Invariants worth memorising
 
 * The manifest CAS is the only commit point; everything before it is invisible, everything after it is
   idempotent and replayable.
-* Immutable objects are content-addressed; nothing is overwritten except the manifest, the bundle list and leases.
+* Immutable objects are content-addressed; mutable control objects are explicitly named in `AGENTS.md` (manifest, leases, settings-related control and caches).
 * Every read revalidates against the bucket first; there is no "eventually".
 * Local disk is a cache. Memory is a cache. The bucket is the repository.
 * Placement is configured, never inferred; refs-level reads work everywhere, object work only where placed.
diff --git a/crates/walgit-bundle/Cargo.toml b/crates/walgit-bundle/Cargo.toml
deleted file mode 100644
index d5d829f..0000000
--- a/crates/walgit-bundle/Cargo.toml
+++ /dev/null
@@ -1,37 +0,0 @@
-[package]
-name = "walgit-bundle"
-version.workspace = true
-edition.workspace = true
-license.workspace = true
-
-[dependencies]
-parking_lot.workspace = true
-walgit-proto.workspace = true
-walgit-store.workspace = true
-walgit-config.workspace = true
-walgit-git.workspace = true
-walgit-wal = { workspace = true, optional = true }
-anyhow.workspace = true
-thiserror.workspace = true
-bytes.workspace = true
-futures.workspace = true
-tokio.workspace = true
-tracing.workspace = true
-metrics.workspace = true
-cron.workspace = true
-chrono.workspace = true
-hex.workspace = true
-sha1.workspace = true
-async-trait.workspace = true
-prost.workspace = true
-tempfile.workspace = true
-
-[dev-dependencies]
-tokio = { workspace = true, features = ["full", "test-util"] }
-
-[features]
-default = []
-wal = ["dep:walgit-wal"]
-
-[lints]
-workspace = true
diff --git a/crates/walgit-bundle/src/lib.rs b/crates/walgit-bundle/src/lib.rs
deleted file mode 100644
index 709ed97..0000000
--- a/crates/walgit-bundle/src/lib.rs
+++ /dev/null
@@ -1,918 +0,0 @@
-#![allow(clippy::unused_self, clippy::doc_lazy_continuation)]
-//! bundle-uri: scheduled full/incremental bundle strategies, bundle list.
-//! See AGENTS.md Phase 5 and docs/CONTRACT.md `walgit-bundle`.
-//!
-//! # Architecture
-//!
-//! The [`Bundler`] is the public entry point. It depends on a [`BundleSource`]
-//! trait that provides repo-scoped access (local git repo + [`Prefixed`] store
-//! + `head_seq`). When `walgit_wal::Registry` lands it will implement
-//! `BundleSource` (impl lives in this crate) and the `new` signature will
-//! accept `Arc<Registry>` directly. Until then, [`Bundler::new_with_source`]
-//! accepts any `BundleSource` impl (used by tests).
-//!
-//! The core operations in [`ops`] take a [`walgit_git::LocalRepo`] + [`Prefixed`]
-//! store so they are unit-testable with upstream `git` + [`MemoryStore`] without
-//! the full WAL stack.
-
-pub mod ops;
-pub mod render;
-pub mod schedule;
-pub mod slots;
-
-use std::sync::Arc;
-use std::time::{Duration, SystemTime};
-
-use thiserror::Error;
-use tracing::{debug, warn};
-
-use walgit_config::Config;
-use walgit_git::{GitError, LocalRepo};
-use walgit_proto::time;
-use walgit_proto::v1::{BundleEntry, BundleList};
-use walgit_store::Prefixed;
-
-pub use ops::LeaseGuard;
-pub use walgit_git::{RefSnapshotData, RepoId};
-// ---------------------------------------------------------------------------
-// Error
-// ---------------------------------------------------------------------------
-
-/// Error type for all bundle operations.
-#[derive(Debug, Error)]
-pub enum BundleError {
-    #[error("store error: {0}")]
-    Store(#[from] walgit_store::StoreError),
-    #[error("decode error: {0}")]
-    Decode(#[from] prost::DecodeError),
-    #[error("git error: {0}")]
-    Git(#[from] GitError),
-    #[error("strategy not found: {0}")]
-    StrategyNotFound(String),
-    #[error("repo not found: {0}")]
-    RepoNotFound(String),
-    #[error("invalid repo id: {0}")]
-    InvalidRepoId(String),
-    #[error("invalid schedule: {0}")]
-    InvalidSchedule(String),
-    #[error("io error: {0}")]
-    Io(String),
-    #[error("bundle not found: {0}")]
-    BundleNotFound(String),
-    #[error("no refs to bundle")]
-    NoRefs,
-    #[error("no new objects since base — bundle would be empty")]
-    NoNewObjects,
-    /// Minimum-size gate (`bundles.min_commits`): the incremental would carry
-    /// fewer commits than the floor — not built, plan state `too-small`.
-    #[error("too small: {commits} commits since the base bundle (min {min})")]
-    TooSmall { commits: u64, min: u64 },
-    /// The tip set equals the newest incremental of the strategy on the same
-    /// base: the bundle would be identical to `since` — not built.
-    #[error("unchanged since {since}")]
-    Unchanged { since: String },
-    #[error("CAS retries exhausted")]
-    RetriesExhausted,
-    #[error("other: {0}")]
-    Other(String),
-}
-
-// ---------------------------------------------------------------------------
-// BundleSource trait + handle
-// ---------------------------------------------------------------------------
-
-/// A handle to an open repo for bundle operations.
-///
-/// When `walgit_wal::RepoHandle` lands, `BundleSource::open_repo` will
-/// construct this from `handle.local().clone()`, `handle.store().clone()`,
-/// and `handle.manifest().head_seq`.
-pub struct BundleRepoHandle {
-    /// Local git repository (bare, on disk).
-    pub local: LocalRepo,
-    /// Repo-scoped store (prefix = `repos/<owner>/<repo>/`).
-    pub store: Prefixed,
-    /// Current WAL head sequence number.
-    pub head_seq: u64,
-    /// How packs are produced here (set by `prepare_objects`; see [`BundleEngine`]).
-    pub engine: BundleEngine,
-    /// D24: the repository's effective config (host ⊕ settings). `None` =
-    /// the bundler's own (tests, sources without settings).
-    pub cfg: Option<Arc<Config>>,
-}
-
-/// Which engine writes a bundle's pack.
-#[derive(Clone, Default)]
-pub enum BundleEngine {
-    /// `git bundle create` on a complete local copy (every pack real).
-    #[default]
-    Git,
-    /// The gix engine (`LocalRepo::write_bundle_gix`): the base pack is
-    /// linked from a store mount or served remotely, so enumeration must be
-    /// a tree diff (stock git would read every tree of the boundary commits
-    /// through the mount, or fail). Only **incremental** bundles are built
-    /// this way; full bundles of such repos are the VM job's (compose).
-    Gix {
-        faulter: Option<std::sync::Arc<dyn walgit_git::ObjectFaulter>>,
-    },
-}
-
-/// Abstraction over the registry: provides repo access and listing.
-///
-/// `walgit_wal::Registry` will implement this trait (impl in this crate)
-/// when Wal lands.
-#[async_trait::async_trait]
-pub trait BundleSource: Send + Sync + 'static {
-    /// Open a repo for bundle operations (list/render: refs + store only;
-    /// must be cheap and must not take the repo's write lock — callers may
-    /// hold a read guard). Error if the repo doesn't exist.
-    async fn open_repo(&self, id: &RepoId) -> Result<BundleRepoHandle, BundleError>;
-    /// Make the repo's objects readable locally before a build (`git bundle
-    /// create` streams from the local copy). Called by `build`/`run_due` only,
-    /// never while a guard is held. Default: nothing to do.
-    async fn prepare_objects(&self, _id: &RepoId) -> Result<(), BundleError> {
-        Ok(())
-    }
-    /// Engine for building `id`'s bundles (after `prepare_objects`). Default: git.
-    async fn engine(&self, _id: &RepoId) -> BundleEngine {
-        BundleEngine::Git
-    }
-    /// Ref state of `id` as of `at` (+ the WAL seq it corresponds to), for
-    /// cutting a calendar slot's bundle. Default: not supported → the
-    /// current refs are used (seq 0).
-    async fn refs_as_of(
-        &self,
-        _id: &RepoId,
-        _at: SystemTime,
-    ) -> Result<Option<(RefSnapshotData, u64)>, BundleError> {
-        Ok(None)
-    }
-    /// List all known repos.
-    async fn list_repos(&self) -> Result<Vec<RepoId>, BundleError>;
-}
-
-// ---------------------------------------------------------------------------
-// Bundler
-// ---------------------------------------------------------------------------
-
-/// The bundle builder. Evaluates schedules, builds full/incremental bundles,
-/// manages the bundle list, and renders advertisement data.
-pub struct Bundler {
-    source: Arc<dyn BundleSource>,
-    cfg: Arc<Config>,
-    lease_ttl: Duration,
-    /// Slots measured under the minimum-size gate: (repo, strategy, slot) →
-    /// commits. In-memory (this maintainer's view); the plan shows `too-small`.
-    gates: parking_lot::Mutex<std::collections::HashMap<(String, String, u64), u64>>,
-}
-
-impl Bundler {
-    /// Create a bundler from any [`BundleSource`]. Used by tests and
-    /// internally by [`Bundler::new`] (which requires `walgit-wal`).
-    pub fn new_with_source(source: Arc<dyn BundleSource>, cfg: Arc<Config>) -> Arc<Self> {
-        Arc::new(Self {
-            source,
-            cfg,
-            gates: parking_lot::Mutex::default(),
-            lease_ttl: Duration::from_mins(30),
-        })
-    }
-
-    /// Create a bundler backed by `walgit_wal::Registry`.
-    /// Available when the `wal` feature is enabled.
-    #[cfg(feature = "wal")]
-    pub fn new(registry: Arc<walgit_wal::Registry>, cfg: Arc<Config>) -> Arc<Self> {
-        Self::new_with_source(registry, cfg)
-    }
-
-    /// Find a strategy config by name.
-    /// The config to plan/build `handle`'s repository with (D24).
-    fn cfg_for<'a>(&'a self, handle: &'a BundleRepoHandle) -> &'a Config {
-        handle.cfg.as_deref().unwrap_or(&self.cfg)
-    }
-
-    fn find_strategy<'a>(
-        &self,
-        cfg: &'a Config,
-        name: &str,
-    ) -> Result<&'a walgit_config::BundleStrategy, BundleError> {
-        cfg.bundles
-            .strategy
-            .iter()
-            .find(|s| s.name == name)
-            .ok_or_else(|| BundleError::StrategyNotFound(name.to_string()))
-    }
-
-    /// Build a bundle for `strategy` (and its base, if needed) and update the
-    /// bundle list.
-    pub async fn build(&self, id: &RepoId, strategy: &str) -> Result<BundleEntry, BundleError> {
-        self.source.prepare_objects(id).await?;
-        let mut handle = self.source.open_repo(id).await?;
-        handle.engine = self.source.engine(id).await;
-        self.build_with_handle(&handle, strategy).await
-    }
-
-    /// Internal build that reuses an open handle (avoids re-opening for the
-    /// recursive base-build case).
-    async fn build_with_handle(
-        &self,
-        handle: &BundleRepoHandle,
-        strategy_name: &str,
-    ) -> Result<BundleEntry, BundleError> {
-        let cut = ops::Cut {
-            slot: 0,
-            snapshot: None,
-            seq: handle.head_seq,
-        };
-        self.build_slot(handle, strategy_name, &cut).await
-    }
-
-    /// Build `strategy_name` for `cut` (a calendar slot with its ref state, or
-    /// "now" when `cut.slot == 0`). Incremental prerequisites = the newest base
-    /// bundle with token ≤ the slot (or the newest at all for "now").
-    async fn build_slot(
-        &self,
-        handle: &BundleRepoHandle,
-        strategy_name: &str,
-        cut: &ops::Cut,
-    ) -> Result<BundleEntry, BundleError> {
-        let cfg = self.cfg_for(handle);
-        let strat = self.find_strategy(cfg, strategy_name)?;
-        let store = &handle.store;
-        let refs = slots::default_refs(&cfg.bundles, strat);
-
-        // Determine prerequisites for incremental bundles.
-        let (base_id, prerequisites) = match strat.kind {
-            walgit_config::BundleKind::Full => (String::new(), Vec::new()),
-            walgit_config::BundleKind::Incremental => {
-                let base_name = strat.base.as_deref().ok_or_else(|| {
-                    BundleError::Other(format!("strategy {strategy_name} has no base"))
-                })?;
-                let list = ops::read_list(store).await?.unwrap_or_default();
-                // One rule for both topologies (`slots::base_for_incremental`): up the chain (daily,
-                // else weekly) — never block an incremental on a base strategy that has no bundle
-                // yet, and never cut the base at THIS slot (a daily with an hourly's slot/token was
-                // the old fallback) — or, `chain = true`, this strategy's own previous bundle.
-                let base =
-                    slots::base_for_incremental(&cfg.bundles, &list, strat, cut.slot).cloned();
-                match base {
-                    Some(base) => {
-                        let prereqs: Vec<String> =
-                            base.tips.iter().map(|t| t.oid.clone()).collect();
-                        (base.id, prereqs)
-                    }
-                    None => {
-                        return Err(BundleError::Other(format!(
-                            "strategy {strategy_name}: no bundle of {base_name} or anything up its chain exists yet — the full root is cut first (compose for a large repository)"
-                        )));
-                    }
-                }
-            }
-        };
-
-        // Incrementals only (fulls are never gated): identical to the previous
-        // incremental on this base → not built; then the minimum-size gate.
-        if strat.kind == walgit_config::BundleKind::Incremental && !prerequisites.is_empty() {
-            let snap = match &cut.snapshot {
-                Some(s) => s.clone(),
-                None => handle.local.refs().map_err(BundleError::Git)?,
-            };
-            let (_, tips) = ops::filter_refs(&snap, &refs);
-            if cut.slot > 0
-                && let Some(prev) = ops::unchanged_since(
-                    &ops::read_list(store).await?.unwrap_or_default(),
-                    strategy_name,
-                    &base_id,
-                    cut.slot,
-                    &tips,
-                )
-            {
-                return Err(BundleError::Unchanged {
-                    since: prev.id.clone(),
-                });
-            }
-            let min = strat.min_commits.unwrap_or(cfg.bundles.min_commits);
-            if min > 0 {
-                let tip_oids: Vec<String> = tips
-                    .iter()
-                    .filter(|t| {
-                        walgit_git::gix_hash::ObjectId::from_hex(t.oid.as_bytes())
-                            .is_ok_and(|o| handle.local.has_object(&o))
-                    })
-                    .map(|t| t.oid.clone())
-                    .collect();
-                let commits = ops::count_commits(&handle.local, &tip_oids, &prerequisites).await?;
-                metrics::histogram!("walgit_bundle_commits", "strategy" => strategy_name.to_string()).record(metric_u64(commits));
-                tracing::info!(
-                    strategy = strategy_name,
-                    slot = cut.slot,
-                    commits,
-                    min,
-                    "bundle: commits since base"
-                );
-                if commits < min {
-                    self.gates.lock().insert(
-                        (
-                            handle.local.path().display().to_string(),
-                            strategy_name.to_string(),
-                            cut.slot,
-                        ),
-                        commits,
-                    );
-                    return Err(BundleError::TooSmall { commits, min });
-                }
-            }
-        }
-
-        // Compute the next creation token.
-        let list = ops::read_list(store).await?.unwrap_or_default();
-        let prev_token = ops::max_creation_token(&list);
-        let now = SystemTime::now();
-
-        // Build and upload the bundle.
-        let entry = ops::build_and_upload(
-            &handle.local,
-            &handle.engine,
-            store,
-            strategy_name,
-            strat.kind,
-            &refs,
-            &prerequisites,
-            &base_id,
-            cut,
-            prev_token,
-            now,
-            strat.filter.as_deref(),
-        )
-        .await?;
-
-        // CAS update the bundle list (append + prune).
-        let old_list = list;
-        let new_entry = entry.clone();
-        let bcfg = &cfg.bundles;
-        let cas_result = ops::cas_update_list(store, cfg.wal.cas_max_retries, |current| {
-            let mut list = current.cloned().unwrap_or_default();
-            list.mode = "all".into();
-            list.heuristic = "creationToken".into();
-            // Idempotent per slot: replace an entry for the same strategy+token.
-            list.bundles.retain(|b| {
-                !(b.strategy == new_entry.strategy && b.creation_token == new_entry.creation_token)
-            });
-            list.bundles.push(new_entry.clone());
-            slots::retain(bcfg, &mut list);
-            list.updated_at = Some(time::now());
-            Ok(Some(list))
-        })
-        .await?;
-
-        // Delete pruned objects after CAS succeeds.
-        if let Some((_, new_list)) = &cas_result {
-            let pruned = ops::pruned_diff(&old_list, new_list);
-            if !pruned.is_empty() {
-                debug!(count = pruned.len(), "deleting pruned bundle objects");
-                ops::delete_pruned(store, &pruned).await;
-            }
-        }
-
-        Ok(entry)
-    }
-
-    /// Read the current bundle list. `Ok(None)` if no list exists.
-    pub async fn list(&self, id: &RepoId) -> Result<Option<BundleList>, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        ops::read_list(&handle.store).await
-    }
-
-    /// Render the bundle list as git config text for `--bundle-uri` usage.
-    /// `Ok(None)` if no list exists.
-    pub async fn render_list(
-        &self,
-        id: &RepoId,
-        base_url: &str,
-        filter: Option<&str>,
-        fulls: bool,
-    ) -> Result<Option<String>, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        let list = ops::read_list(&handle.store).await?;
-        match list {
-            Some(list) => {
-                let text = render::render_list_text(
-                    &list,
-                    id.owner(),
-                    id.name(),
-                    base_url,
-                    &self.cfg_for(&handle).bundles,
-                    &handle.store,
-                    filter,
-                    fulls,
-                )
-                .await?;
-                Ok(Some(text))
-            }
-            None => Ok(None),
-        }
-    }
-
-    /// Protocol v2 `bundle-uri` command response lines.
-    pub async fn protocol_v2_lines(
-        &self,
-        id: &RepoId,
-        base_url: &str,
-    ) -> Result<Vec<String>, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        let list = ops::read_list(&handle.store).await?.unwrap_or_default();
-        render::protocol_v2_lines(
-            &list,
-            id.owner(),
-            id.name(),
-            base_url,
-            &self.cfg_for(&handle).bundles,
-            &handle.store,
-        )
-        .await
-    }
-
-    /// The slot table of `id` at `now` (see [`slots::plan_with`]); `ctx`
-    /// carries what this host can do and the repo's first WAL state.
-    pub async fn plan(
-        &self,
-        id: &RepoId,
-        now: SystemTime,
-        ctx: slots::PlanContext,
-    ) -> Result<Vec<slots::SlotPlan>, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        let list = ops::read_list(&handle.store).await?.unwrap_or_default();
-        let cfg = self.cfg_for(&handle);
-        let mut rows = slots::plan_with(&cfg.bundles, &list, now, ctx)?;
-        // A strategy whose ref patterns match nothing in the repository (a repo
-        // without `main` under `bundles.main_only`, a pattern typo) can never be
-        // cut: say so in the plan instead of logging `NoRefs` at debug and
-        // leaving the slot `missing` forever (the sim's weekly did exactly that).
-        if let Ok(current) = handle.local.refs_arc() {
-            for strat in &cfg.bundles.strategy {
-                let patterns = slots::default_refs(&cfg.bundles, strat);
-                let (_, tips) = ops::filter_refs(&current, &patterns);
-                if tips.is_empty() {
-                    let why = format!(
-                        "no refs match {} (bundles.main_only = {}): nothing to cut",
-                        patterns.join(", "),
-                        cfg.bundles.main_only
-                    );
-                    for r in rows.iter_mut().filter(|r| {
-                        r.strategy == strat.name && r.status == slots::SlotStatus::Missing
-                    }) {
-                        r.status = slots::SlotStatus::Blocked(why.clone());
-                    }
-                }
-            }
-        }
-        // Slots this instance measured under the floor since its start: show
-        // them as `too-small` (a later measurement or a build replaces it).
-        let gates = self.gates.lock();
-        if !gates.is_empty() {
-            for r in &mut rows {
-                if r.status == slots::SlotStatus::Missing
-                    && let Some(c) = gates.get(&(
-                        handle.local.path().display().to_string(),
-                        r.strategy.clone(),
-                        r.slot,
-                    ))
-                {
-                    let min = cfg
-                        .bundles
-                        .strategy
-                        .iter()
-                        .find(|s| s.name == r.strategy)
-                        .and_then(|s| s.min_commits)
-                        .unwrap_or(cfg.bundles.min_commits);
-                    r.status = slots::SlotStatus::TooSmall { commits: *c, min };
-                }
-            }
-        }
-        Ok(rows)
-    }
-
-    /// Settle every **closed, missing** incremental slot of `id` at refs level —
-    /// no lease, no pack work: resolve the slot's refs as of its time, count
-    /// commits over its base's tips on the commit graph, and when the verdict
-    /// is final (`too-small`, or no state as of the slot) record it in the list
-    /// (`BundleList.skipped`). Slots with real work stay `missing` for the
-    /// unit selection. Returns how many verdicts were recorded. After a
-    /// restart the SSD host spent one 3–4 s unit per closed slot, ~30 passes,
-    /// before reaching the live hour (2026-08-21); this makes that one pass.
-    /// Bring the list to what retention says (D21, 2026-08-22) without waiting for the next
-    /// publish: an idle repository publishes nothing (unchanged/too-small gates), so a list
-    /// that grew under an older rule would otherwise keep its 43 entries forever. Refs-level:
-    /// one conditional GET of the list, and only when something is pruned one CAS + the
-    /// deletes. Returns how many entries were dropped.
-    pub async fn apply_retention(&self, id: &RepoId) -> Result<usize, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        let store = handle.store.clone();
-        let cfg = self.cfg_for(&handle).clone();
-        let Some(list) = ops::read_list(&store).await? else {
-            return Ok(0);
-        };
-        let mut probe = list.clone();
-        if slots::retain(&cfg.bundles, &mut probe).is_empty() {
-            return Ok(0);
-        }
-        let bcfg = cfg.bundles.clone();
-        let cas = ops::cas_update_list(&store, cfg.wal.cas_max_retries, move |current| {
-            let mut next = current.cloned().unwrap_or_default();
-            if slots::retain(&bcfg, &mut next).is_empty() {
-                return Ok(None);
-            }
-            next.updated_at = Some(time::now());
-            Ok(Some(next))
-        })
-        .await?;
-        let Some((_, new_list)) = cas else {
-            return Ok(0);
-        };
-        let pruned = ops::pruned_diff(&list, &new_list);
-        if !pruned.is_empty() {
-            tracing::info!(repo = %id, pruned = pruned.len(), listed = new_list.bundles.len(), "bundle list brought to retention");
-            ops::delete_pruned(&store, &pruned).await;
-        }
-        Ok(pruned.len())
-    }
-
-    pub async fn settle_closed_slots(
-        &self,
-        id: &RepoId,
-        now: SystemTime,
-    ) -> Result<usize, BundleError> {
-        let handle = self.source.open_repo(id).await?;
-        let store = handle.store.clone();
-        let cfg = self.cfg_for(&handle).clone();
-        let list = ops::read_list(&store).await?.unwrap_or_default();
-        let rows = slots::plan(&cfg.bundles, &list, now, true)?;
-        let mut verdicts: Vec<walgit_proto::v1::SkippedSlot> = Vec::new();
-        for strat in cfg
-            .bundles
-            .strategy
-            .iter()
-            .filter(|s| s.kind == walgit_config::BundleKind::Incremental)
-        {
-            let min = strat.min_commits.unwrap_or(cfg.bundles.min_commits);
-            for r in rows.iter().filter(|r| {
-                r.strategy == strat.name
-                    && r.status == slots::SlotStatus::Missing
-                    && slots::slot_closed(strat, r.slot, now)
-            }) {
-                let Some(base_id) = r.base_id.clone() else {
-                    continue;
-                };
-                let Some(base) = list.bundles.iter().find(|b| b.id == base_id) else {
-                    continue;
-                };
-                let at = slots::from_epoch(r.slot);
-                let verdict = match self.source.refs_as_of(id, at).await? {
-                    None => Some((0u64, "no state as of the slot".to_string())),
-                    Some((snap, seq)) => {
-                        let refs = slots::default_refs(&cfg.bundles, strat);
-                        let (_, tips) = ops::filter_refs(&snap, &refs);
-                        if let Some(prev) =
-                            ops::unchanged_since(&list, &strat.name, &base_id, r.slot, &tips)
-                        {
-                            Some((seq, format!("unchanged since {}", prev.id)))
-                        } else if min == 0 {
-                            None
-                        } else {
-                            let prerequisites: Vec<String> =
-                                base.tips.iter().map(|t| t.oid.clone()).collect();
-                            let tip_oids: Vec<String> = tips
-                                .iter()
-                                .filter(|t| {
-                                    walgit_git::gix_hash::ObjectId::from_hex(t.oid.as_bytes())
-                                        .is_ok_and(|o| handle.local.has_object(&o))
-                                })
-                                .map(|t| t.oid.clone())
-                                .collect();
-                            if tip_oids.is_empty() {
-                                None // cannot measure here (tips not local): leave it to a unit
-                            } else {
-                                let commits =
-                                    ops::count_commits(&handle.local, &tip_oids, &prerequisites)
-                                        .await?;
-                                (commits < min).then(|| {
-                                    (
-                                        seq,
-                                        format!(
-                                            "too-small: {commits} commits since base (min {min})"
-                                        ),
-                                    )
-                                })
-                            }
-                        }
-                    }
-                };
-                if let Some((seq, reason)) = verdict {
-                    tracing::debug!(repo = %id, strategy = %strat.name, slot = r.slot, %reason, "closed slot settled at plan time");
-                    verdicts.push(walgit_proto::v1::SkippedSlot {
-                        strategy: strat.name.clone(),
-                        slot: r.slot,
-                        base_id,
-                        as_of_seq: seq,
-                        reason,
-                        at: Some(time::now()),
-                    });
-                }
-            }
-        }
-        // One CAS for the whole pass (ROUNDTRIPS): a verdict per slot would be a round trip per slot.
-        let recorded = verdicts.len();
-        ops::record_skipped_many(&store, verdicts).await?;
-        Ok(recorded)
-    }
-
-    /// Build exactly **one** slot (`strategy` at `slot`) as a unit of the
-    /// maintenance loop: lease on the strategy, objects prepared, content =
-    /// WAL state as of the slot. Returns `Ok(None)` when the slot was built by
-    /// someone else meanwhile or has no new objects / refs (then it stays
-    /// missing; the next slot covers it).
-    pub async fn build_slot_unit(
-        &self,
-        id: &RepoId,
-        strategy: &str,
-        slot: u64,
-    ) -> Result<Option<BundleEntry>, BundleError> {
-        let mut handle = self.source.open_repo(id).await?;
-        let cfg = self.cfg_for(&handle).clone();
-        let strat = self.find_strategy(&cfg, strategy)?.clone();
-        let strat = &strat;
-        let store = handle.store.clone();
-        let Some(lease) = ops::try_acquire_lease(&store, &strat.name, self.lease_ttl).await? else {
-            return Ok(None);
-        };
-        let res: Result<Option<BundleEntry>, BundleError> = async {
-            let fresh = ops::read_list(&store).await?.unwrap_or_default();
-            if fresh.bundles.iter().any(|b| b.strategy == strat.name && b.creation_token == slot) {
-                return Ok(None);
-            }
-            self.source.prepare_objects(id).await?;
-            handle.engine = self.source.engine(id).await;
-            if strat.kind == walgit_config::BundleKind::Full && matches!(handle.engine, BundleEngine::Gix { .. }) {
-                return Err(BundleError::Other("full bundle needs the base pack as a local copy on this host".into()));
-            }
-            let at = slots::from_epoch(slot);
-            // Content is the state AS OF the slot (D22). No state at that time:
-            // the first full of a chain is cut from the earliest state there is
-            // ("weekly = import state"); an incremental is NOT built — cutting
-            // it from now would put today's main under an old token (prod
-            // 2026-08-21: eight "08-19/08-20" bundles carried 04:2xZ content).
-            let now = SystemTime::now();
-            let list_now = ops::read_list(&store).await?.unwrap_or_default();
-            let base_id_now = match strat.kind {
-                walgit_config::BundleKind::Full => String::new(),
-                walgit_config::BundleKind::Incremental => slots::base_for_incremental(&cfg.bundles, &list_now, strat, slot).map(|b| b.id.clone()).unwrap_or_default(),
-            };
-            let (snapshot, seq) = match self.source.refs_as_of(id, at).await? {
-                Some((snap, seq)) => (Some(snap), seq),
-                None if strat.kind == walgit_config::BundleKind::Full => (None, handle.head_seq),
-                None => {
-                    tracing::info!(repo = %id, strategy = %strat.name, slot, "no WAL state as of this slot — not cut");
-                    if slots::slot_closed(strat, slot, now) {
-                        ops::record_skipped(&store, &strat.name, slot, &base_id_now, 0, "no state as of the slot").await?;
-                    }
-                    return Ok(None);
-                }
-            };
-            let cut = ops::Cut { slot, snapshot, seq };
-            match self.build_slot(&handle, &strat.name, &cut).await {
-                Ok(e) => Ok(Some(e)),
-                Err(BundleError::TooSmall { commits, min }) => {
-                    tracing::info!(repo = %id, strategy = %strat.name, slot, commits, min, "bundle slot too small — not cut (next slot catches up)");
-                    // Final once the window is closed: the as-of state cannot change.
-                    if slots::slot_closed(strat, slot, now) {
-                        ops::record_skipped(&store, &strat.name, slot, &base_id_now, seq, &format!("too-small: {commits} commits since base (min {min})")).await?;
-                    }
-                    Ok(None)
-                }
-                Err(BundleError::Unchanged { since }) => {
-                    tracing::info!(repo = %id, strategy = %strat.name, slot, %since, "bundle slot unchanged — not cut");
-                    if slots::slot_closed(strat, slot, now) {
-                        ops::record_skipped(&store, &strat.name, slot, &base_id_now, seq, &format!("unchanged since {since}")).await?;
-                    }
-                    Ok(None)
-                }
-                Err(BundleError::NoNewObjects | BundleError::NoRefs) => Ok(None),
-                Err(e) => Err(e),
-            }
-        }
-        .await;
-        lease.release().await.ok();
-        res
-    }
-
-    /// Build every **missing slot** of every strategy for `id` up to `now`,
-    /// oldest first (backfill), each with the ref state as of its slot and
-    /// `creation_token = slot`. One lease per strategy; `backfill_max` bounds
-    /// one pass. Returns the built entries. A slot whose content adds no
-    /// objects over its prerequisite is still recorded? No: it is skipped
-    /// (`NoNewObjects`) and stays missing — the next slot covers it.
-    pub async fn run_due(
-        &self,
-        id: &RepoId,
-        now: SystemTime,
-    ) -> Result<Vec<BundleEntry>, BundleError> {
-        let mut handle = self.source.open_repo(id).await?;
-        let store = handle.store.clone();
-        let store = &store;
-        let mut built = Vec::new();
-        let mut prepared = false;
-
-        let list = ops::read_list(store).await?.unwrap_or_default();
-        let can_full_guess = true;
-        let cfg = self.cfg_for(&handle).clone();
-        let rows = slots::plan(&cfg.bundles, &list, now, can_full_guess)?;
-        // Strategies in config order (base before incrementals), slots oldest first.
-        for strat in &cfg.bundles.strategy {
-            let missing: Vec<&slots::SlotPlan> = rows
-                .iter()
-                .filter(|r| r.strategy == strat.name && r.status == slots::SlotStatus::Missing)
-                .collect();
-            if missing.is_empty() {
-                continue;
-            }
-            let Some(lease) = ops::try_acquire_lease(store, &strat.name, self.lease_ttl).await?
-            else {
-                debug!(strategy = %strat.name, "lease held, skipping");
-                continue;
-            };
-            let res: Result<(), BundleError> = async {
-                if !prepared {
-                    self.source.prepare_objects(id).await?;
-                    handle.engine = self.source.engine(id).await;
-                    prepared = true;
-                }
-                if strat.kind == walgit_config::BundleKind::Full && matches!(handle.engine, BundleEngine::Gix { .. }) {
-                    debug!(strategy = %strat.name, "full bundle of a linked/remote-served base: built by the VM job (compose)");
-                    return Ok(());
-                }
-                // Re-read the list under the lease: a sibling may have built some.
-                let fresh = ops::read_list(store).await?.unwrap_or_default();
-                let rows = slots::plan(&cfg.bundles, &fresh, now, true)?;
-                let mut todo: Vec<u64> = rows
-                    .iter()
-                    .filter(|r| r.strategy == strat.name && r.status == slots::SlotStatus::Missing)
-                    .map(|r| r.slot)
-                    .collect();
-                todo.sort_unstable();
-                if strat.backfill_max > 0 && todo.len() > strat.backfill_max {
-                    // Oldest first, bounded: the rest next pass.
-                    todo.truncate(strat.backfill_max);
-                }
-                for slot in todo {
-                    let at = slots::from_epoch(slot);
-                    let (snapshot, seq) = match self.source.refs_as_of(id, at).await? {
-                        Some((snap, seq)) => (Some(snap), seq),
-                        None => (None, handle.head_seq),
-                    };
-                    let cut = ops::Cut { slot, snapshot, seq };
-                    match self.build_slot(&handle, &strat.name, &cut).await {
-                        Ok(entry) => {
-                            debug!(strategy = %strat.name, slot, seq, "slot built");
-                            built.push(entry);
-                        }
-                        Err(BundleError::NoNewObjects) => {
-                            debug!(strategy = %strat.name, slot, "no new objects for this slot, skipped");
-                        }
-                        Err(BundleError::NoRefs) => {
-                            debug!(strategy = %strat.name, slot, "no refs at this slot, skipped");
-                        }
-                        Err(BundleError::TooSmall { commits, min }) => {
-                            debug!(strategy = %strat.name, slot, commits, min, "too small, skipped");
-                        }
-                        Err(BundleError::Unchanged { since }) => {
-                            debug!(strategy = %strat.name, slot, %since, "unchanged, skipped");
-                        }
-                        Err(e) => return Err(e),
-                    }
-                }
-                Ok(())
-            }
-            .await;
-            lease.release().await.ok();
-            res?;
-        }
-        Ok(built)
-    }
-
-    /// Run `run_due` for every repo in the registry.
-    pub async fn run_all_due(&self, now: SystemTime) -> Result<(), BundleError> {
-        let repos = self.source.list_repos().await?;
-        for id in &repos {
-            match self.run_due(id, now).await {
-                Ok(entries) => {
-                    if !entries.is_empty() {
-                        debug!(repo = %id, count = entries.len(), "built bundles");
-                    }
-                }
-                // An empty repository has nothing to bundle; that is not a failure.
-                Err(BundleError::NoRefs) => {
-                    debug!(repo = %id, "no refs to bundle yet");
-                }
-                // Pack set too large for this instance: bundles for it are built
-                // by the VM job (weekly = compose). Not a failure, not noise.
-                Err(e) if e.to_string().contains("larger than this instance") => {
-                    debug!(repo = %id, "bundle build skipped: pack set does not fit here");
-                }
-                Err(e) => {
-                    warn!(repo = %id, error = %e, "run_due failed");
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-/// Metrics use `f64`; values beyond its exact integer range are still useful as
-/// approximate counters.
-#[allow(clippy::cast_precision_loss)]
-fn metric_u64(value: u64) -> f64 {
-    value as f64
-}
-
-// ---------------------------------------------------------------------------
-// BundleSource impl for walgit_wal::Registry (behind 'wal' feature)
-// ---------------------------------------------------------------------------
-
-/// Pick the engine for a synced WAL repo: gix (+ remote faulter) when its base
-/// is remote-served or linked from a store mount, git otherwise.
-#[cfg(feature = "wal")]
-pub async fn bundle_engine(handle: &walgit_wal::RepoHandle) -> BundleEngine {
-    if !handle.remote_served().is_empty() {
-        match handle.remote_reader().await {
-            Ok(reader) => {
-                return BundleEngine::Gix {
-                    faulter: Some(std::sync::Arc::new(walgit_wal::remote::Faulter::new(
-                        reader,
-                        handle.local().clone(),
-                    ))),
-                };
-            }
-            Err(e) => {
-                warn!(repo = %handle.id(), error = %e, "remote reader unavailable for bundle build; using git");
-            }
-        }
-    }
-    let linked = handle.local().packs().is_ok_and(|ps| {
-        ps.iter()
-            .any(|p| handle.local().pack_path(&p.checksum).is_symlink())
-    });
-    if linked {
-        return BundleEngine::Gix { faulter: None };
-    }
-    BundleEngine::Git
-}
-
-#[cfg(feature = "wal")]
-mod wal_impl {
-    use super::{BundleEngine, BundleError, BundleRepoHandle, BundleSource, RepoId, bundle_engine};
-    use walgit_wal::{Registry, WalError};
-
-    fn wal_err(e: WalError) -> BundleError {
-        match e {
-            WalError::NotFound => BundleError::RepoNotFound("not found".into()),
-            WalError::Git(e) => BundleError::Git(e),
-            WalError::Store(e) => BundleError::Store(e),
-            other => BundleError::Other(other.to_string()),
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl BundleSource for Registry {
-        async fn prepare_objects(&self, id: &RepoId) -> Result<(), BundleError> {
-            // `git bundle create` streams objects from the local copy: bring
-            // the packs here first (Serve level; too-large repos surface as
-            // "larger than this instance" and are skipped by run_all_due).
-            // Registry::open alone is refs-level — building from it produced
-            // "fatal: bad object refs/heads/main" on the maintainer.
-            let handle = self.open(id).await.map_err(wal_err)?;
-            drop(handle.sync().await.map_err(wal_err)?);
-            Ok(())
-        }
-
-        async fn open_repo(&self, id: &RepoId) -> Result<BundleRepoHandle, BundleError> {
-            let handle = self.open(id).await.map_err(wal_err)?;
-            Ok(BundleRepoHandle {
-                local: handle.local().clone(),
-                store: handle.store().clone(),
-                head_seq: handle.manifest().head_seq,
-                engine: BundleEngine::Git,
-                cfg: Some(handle.effective_config()),
-            })
-        }
-
-        async fn engine(&self, id: &RepoId) -> BundleEngine {
-            match self.open(id).await {
-                Ok(h) => bundle_engine(&h).await,
-                Err(_) => BundleEngine::Git,
-            }
-        }
-
-        async fn list_repos(&self) -> Result<Vec<RepoId>, BundleError> {
-            self.list().await.map_err(wal_err)
-        }
-    }
-}
diff --git a/crates/walgit-bundle/src/ops.rs b/crates/walgit-bundle/src/ops.rs
deleted file mode 100644
index bd9442d..0000000
--- a/crates/walgit-bundle/src/ops.rs
+++ /dev/null
@@ -1,1235 +0,0 @@
-#![allow(clippy::needless_continue, clippy::too_many_arguments)]
-//! Core bundling operations: ref resolution, bundle creation, store upload,
-//! bundle-list CAS management, pruning, and per-strategy leasing.
-//!
-//! The core functions take a [`LocalRepo`] + [`Prefixed`] store so they are
-//! testable without the full WAL/Registry stack.
-
-use std::collections::HashSet;
-use std::path::Path;
-use std::sync::LazyLock;
-use std::time::{Duration, SystemTime};
-
-use prost::Message;
-use sha1::{Digest, Sha1};
-use tracing::Instrument;
-use tracing::{debug, warn};
-
-use walgit_config::BundleKind;
-use walgit_git::{GitError, LocalRepo, RefSnapshotData};
-use walgit_proto::v1::{BundleEntry, BundleList, Lease, Ref};
-use walgit_proto::{keys, time};
-use walgit_store::{
-    ObjectStore, ObjectStoreExt, Prefixed, PutBody, PutMode, PutOptions, StoreError, Version,
-};
-
-use crate::BundleError;
-
-// ---------------------------------------------------------------------------
-// Instance identity (for lease holder)
-// ---------------------------------------------------------------------------
-
-/// Per-process unique identifier for lease holding.
-pub fn instance_id() -> &'static str {
-    static ID: LazyLock<String> = LazyLock::new(|| {
-        format!(
-            "bundle-{}-{}",
-            std::process::id(),
-            chrono::Utc::now().timestamp()
-        )
-    });
-    ID.as_str()
-}
-
-// ---------------------------------------------------------------------------
-// Ref resolution / filtering
-// ---------------------------------------------------------------------------
-
-/// Check whether a ref name matches a glob-style pattern.
-///
-/// `refs/heads/*` matches `refs/heads/main`, `refs/heads/feature/x`.
-/// `HEAD` matches only `HEAD`. Exact names match exactly.
-fn matches_pattern(ref_name: &str, pattern: &str) -> bool {
-    if pattern == "HEAD" {
-        return ref_name == "HEAD";
-    }
-    if let Some(prefix) = pattern.strip_suffix("/*") {
-        // Glob: prefix matches anything under that path segment.
-        return ref_name == prefix || ref_name.starts_with(&format!("{prefix}/"));
-    }
-    ref_name == pattern
-}
-
-/// Filter refs from a [`RefSnapshotData`] by strategy ref patterns.
-///
-/// Empty patterns default to `refs/heads/*`, `refs/tags/*`, `HEAD`.
-/// Returns `(ref_names_for_bundle, tips_for_entry)`.
-///
-/// `ref_names` includes `HEAD` if appropriate; `tips` are proto `Ref`s with
-/// name + oid + peeled.
-pub(crate) fn filter_refs(snap: &RefSnapshotData, patterns: &[String]) -> (Vec<String>, Vec<Ref>) {
-    let effective: Vec<&str> = if patterns.is_empty() {
-        vec!["refs/heads/*", "refs/tags/*", "HEAD"]
-    } else {
-        patterns.iter().map(std::string::String::as_str).collect()
-    };
-
-    let mut ref_names = Vec::new();
-    let mut tips = Vec::new();
-
-    for r in &snap.refs {
-        if effective.iter().any(|p| matches_pattern(&r.name, p)) {
-            ref_names.push(r.name.clone());
-            tips.push(Ref {
-                name: r.name.clone(),
-                oid: r.oid.clone(),
-                peeled: r.peeled.clone(),
-            });
-        }
-    }
-
-    // Include HEAD if requested and not already captured as a named ref.
-    let want_head = effective.contains(&"HEAD");
-    if want_head && !ref_names.iter().any(|n| n == "HEAD") {
-        // HEAD's oid = the oid of head_target (if set).
-        if let Some(head_ref) = snap.refs.iter().find(|r| r.name == snap.head_target) {
-            ref_names.push("HEAD".into());
-            tips.push(Ref {
-                name: "HEAD".into(),
-                oid: head_ref.oid.clone(),
-                peeled: String::new(),
-            });
-        }
-    }
-
-    (ref_names, tips)
-}
-
-// ---------------------------------------------------------------------------
-// Bundle file creation
-// ---------------------------------------------------------------------------
-
-/// Create a bundle at `out`: header (tips, `-<prerequisite>` lines) + a
-/// self-contained pack of exactly the objects reachable from `refs` minus the
-/// prerequisites (gix engine: `write_bundle_gix`; git: `pack-objects --revs`,
-/// never thin — see the comment in the body). Returns the bundle file size.
-pub async fn create_bundle(
-    local: &LocalRepo,
-    engine: &crate::BundleEngine,
-    out: &Path,
-    refs: &[String],
-    tips: &[Ref],
-    prerequisites: &[String],
-    filter: Option<&str>,
-) -> Result<u64, BundleError> {
-    if let crate::BundleEngine::Gix { faulter } = engine {
-        if filter.is_some() {
-            return Err(BundleError::Other(
-                "filtered bundles need the stock git engine (gix engine cannot pack --filter)"
-                    .into(),
-            ));
-        }
-        let mut ref_oids = Vec::with_capacity(refs.len());
-        for name in refs {
-            let Some(t) = tips.iter().find(|t| &t.name == name) else {
-                continue;
-            };
-            let oid = walgit_git::gix_hash::ObjectId::from_hex(t.oid.as_bytes())
-                .map_err(|e| BundleError::Other(format!("bad tip {}: {e}", t.oid)))?;
-            ref_oids.push((name.clone(), oid));
-        }
-        let mut prereqs = Vec::with_capacity(prerequisites.len());
-        for p in prerequisites {
-            prereqs.push(
-                walgit_git::gix_hash::ObjectId::from_hex(p.as_bytes())
-                    .map_err(|e| BundleError::Other(format!("bad prerequisite {p}: {e}")))?,
-            );
-        }
-        let file = tokio::fs::File::create(out)
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-        let mut w = tokio::io::BufWriter::new(file);
-        let stats = local
-            .write_bundle_gix(&mut w, &ref_oids, &prereqs, faulter.as_deref())
-            .await
-            .map_err(BundleError::Git)?;
-        tokio::io::AsyncWriteExt::shutdown(&mut w)
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-        if stats.objects == 0 {
-            return Err(BundleError::NoNewObjects);
-        }
-        return Ok(std::fs::metadata(out).map_or(0, |m| m.len()));
-    }
-    // Stock git: our own header + `pack-objects` WITHOUT `--thin`. `git bundle
-    // create` always packs thin (deltas against the prerequisites' objects),
-    // which is the wrong trade for a static incremental: measured on a large repository's
-    // 07:00 hourly (2026-08-21, same object set) thin = 226.8 MB and a 48.4 s
-    // client `index-pack` that appended 193 MB of bases (420 MB on disk);
-    // self-contained = 314.9 MB (+39 %), 31.7 s (−35 %), 315 MB on disk. Static
-    // bytes are the cheap resource (edge cache, CDN, bucket); client seconds and
-    // client disk are not. Prerequisites still bound the object set exactly.
-    let repo_path = local.path();
-    let git = |args: &[&str]| {
-        let mut c = tokio::process::Command::new("git");
-        c.args(args)
-            .current_dir(repo_path)
-            .env("GIT_DIR", repo_path);
-        c
-    };
-    // Resolve every ref to write the header (HEAD included, as git would).
-    let mut header = bundle_prelude(local.object_format(), filter);
-    // Prerequisites are commits (git peels `^<tag>` for `bundle create`; we do
-    // the same) — deduped, non-commits dropped.
-    let mut prereq_commits: Vec<String> = Vec::with_capacity(prerequisites.len());
-    for p in prerequisites {
-        let out = git(&["rev-parse", "--verify", "-q", &format!("{p}^{{commit}}")])
-            .output()
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-        if out.status.success() {
-            let c = String::from_utf8_lossy(&out.stdout).trim().to_string();
-            if !prereq_commits.contains(&c) {
-                prereq_commits.push(c);
-            }
-        }
-    }
-    for p in &prereq_commits {
-        // `-<oid> <comment>`: git reads the oid and ignores the rest.
-        header.extend_from_slice(format!("-{p} walgit\n").as_bytes());
-    }
-    let mut revs = String::new();
-    for r in refs {
-        // The ref's own object (an annotated tag stays a tag: clients expect the
-        // tag oid under refs/tags/*; the tag object itself is in the pack).
-        let out = git(&["rev-parse", "--verify", "-q", r])
-            .output()
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-        if !out.status.success() {
-            continue; // unresolvable tip: skipped (the caller already warned)
-        }
-        let oid = String::from_utf8_lossy(&out.stdout).trim().to_string();
-        header.extend_from_slice(format!("{oid} {r}\n").as_bytes());
-        revs.push_str(&oid);
-        revs.push('\n');
-    }
-    header.push(b'\n');
-    if revs.is_empty() {
-        return Err(BundleError::NoRefs);
-    }
-    for p in &prereq_commits {
-        revs.push('^');
-        revs.push_str(p);
-        revs.push('\n');
-    }
-    let mut po_args: Vec<String> = [
-        "pack-objects",
-        "--revs",
-        "--delta-base-offset",
-        "-q",
-        "--stdout",
-    ]
-    .iter()
-    .map(std::string::ToString::to_string)
-    .collect();
-    if let Some(f) = filter {
-        po_args.push(format!("--filter={f}"));
-    }
-    let po_args: Vec<&str> = po_args.iter().map(std::string::String::as_str).collect();
-    let mut child = git(&po_args)
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::piped())
-        .stderr(std::process::Stdio::piped())
-        .spawn()
-        .map_err(|e| BundleError::Io(e.to_string()))?;
-    {
-        use tokio::io::AsyncWriteExt;
-        let mut stdin = child
-            .stdin
-            .take()
-            .ok_or_else(|| BundleError::Io("git pack-objects stdin was not piped".into()))?;
-        stdin
-            .write_all(revs.as_bytes())
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-        drop(stdin);
-    }
-    let mut file = tokio::io::BufWriter::new(
-        tokio::fs::File::create(out)
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?,
-    );
-    {
-        use tokio::io::AsyncWriteExt;
-        file.write_all(&header)
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-    }
-    let mut stdout = child
-        .stdout
-        .take()
-        .ok_or_else(|| BundleError::Io("git pack-objects stdout was not piped".into()))?;
-    let mut first = [0u8; 12];
-    tokio::io::AsyncReadExt::read_exact(&mut stdout, &mut first)
-        .await
-        .map_err(|e| BundleError::Io(format!("pack header: {e}")))?;
-    let count_bytes: [u8; 4] = first
-        .get(8..12)
-        .and_then(|bytes| bytes.try_into().ok())
-        .ok_or_else(|| BundleError::Other("pack header lacks an object count".into()))?;
-    let objects = u32::from_be_bytes(count_bytes);
-    {
-        use tokio::io::AsyncWriteExt;
-        file.write_all(&first)
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-    }
-    tokio::io::copy(&mut stdout, &mut file)
-        .await
-        .map_err(|e| BundleError::Io(e.to_string()))?;
-    {
-        use tokio::io::AsyncWriteExt;
-        file.flush()
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?;
-    }
-    let status = child
-        .wait_with_output()
-        .await
-        .map_err(|e| BundleError::Io(e.to_string()))?;
-    if !status.status.success() {
-        return Err(BundleError::Git(GitError::Subprocess {
-            cmd: "git pack-objects --revs (bundle)".into(),
-            status: status.status.code(),
-            stderr: String::from_utf8_lossy(&status.stderr).to_string(),
-        }));
-    }
-    if objects == 0 {
-        let _ = tokio::fs::remove_file(out).await;
-        return Err(BundleError::NoNewObjects);
-    }
-    let meta = tokio::fs::metadata(out)
-        .await
-        .map_err(|e| BundleError::Io(e.to_string()))?;
-    Ok(meta.len())
-}
-
-// ---------------------------------------------------------------------------
-// Checksum and key generation
-// ---------------------------------------------------------------------------
-
-/// SHA-1 hex digest of the bundle file content (content-addressed key).
-pub fn bundle_checksum(data: &[u8]) -> String {
-    let mut hasher = Sha1::new();
-    hasher.update(data);
-    hex::encode(hasher.finalize())
-}
-
-/// [`bundle_checksum`] over a file, streamed.
-pub fn bundle_checksum_file(path: &std::path::Path) -> std::io::Result<String> {
-    use std::io::Read;
-    let mut f = std::fs::File::open(path)?;
-    let mut hasher = Sha1::new();
-    let mut buf = vec![0u8; 1 << 20];
-    loop {
-        let n = f.read(&mut buf)?;
-        if n == 0 {
-            break;
-        }
-        let chunk = buf
-            .get(..n)
-            .ok_or_else(|| std::io::Error::other("read exceeded checksum buffer"))?;
-        hasher.update(chunk);
-    }
-    Ok(hex::encode(hasher.finalize()))
-}
-
-/// RFC 3339 compact timestamp: `20260818T120000Z`.
-pub fn rfc3339_compact(now: SystemTime) -> String {
-    let dt = chrono::DateTime::<chrono::Utc>::from(now);
-    dt.format("%Y%m%dT%H%M%SZ").to_string()
-}
-
-/// Build the object key: `bundles/<strategy>/<compact>-<checksum>.bundle`.
-pub fn bundle_key(strategy: &str, now: SystemTime, checksum: &str) -> String {
-    format!(
-        "bundles/{strategy}/{}-{checksum}.bundle",
-        rfc3339_compact(now)
-    )
-}
-
-// ---------------------------------------------------------------------------
-// Bundle list read / CAS update
-// ---------------------------------------------------------------------------
-
-/// Read `bundles/list.pb` from the repo-scoped store. `Ok(None)` if absent.
-pub async fn read_list(store: &Prefixed) -> Result<Option<BundleList>, BundleError> {
-    match store.get_bytes(keys::BUNDLE_LIST).await? {
-        Some((_, data)) => {
-            let list = BundleList::decode(data.as_ref())?;
-            Ok(Some(list))
-        }
-        None => Ok(None),
-    }
-}
-
-/// Record a closed slot's verdict in the list (idempotent per (strategy, slot, base)).
-pub async fn record_skipped(
-    store: &Prefixed,
-    strategy: &str,
-    slot: u64,
-    base_id: &str,
-    as_of_seq: u64,
-    reason: &str,
-) -> Result<(), BundleError> {
-    record_skipped_many(
-        store,
-        vec![walgit_proto::v1::SkippedSlot {
-            strategy: strategy.to_string(),
-            slot,
-            base_id: base_id.to_string(),
-            as_of_seq,
-            reason: reason.to_string(),
-            at: Some(time::now()),
-        }],
-    )
-    .await
-}
-
-/// Upper bound on recorded verdicts: the plan only looks at slots inside the retention window
-/// (≤ 1 weekly period of dailies, ≤ 1 daily period of hourlies, per family), so anything older is
-/// irrelevant; the newest verdicts (by slot) are the ones kept.
-pub const SKIPPED_KEPT: usize = 4096;
-
-/// Record many verdicts in **one** CAS of the list (one settle pass = one round trip, however many
-/// closed slots it judged; 2026-08-22 a rig repo settled 9,654 slots per pass, one CAS each, and the
-/// verdicts beyond the cap never stuck, so every pass did it again).
-pub async fn record_skipped_many(
-    store: &Prefixed,
-    verdicts: Vec<walgit_proto::v1::SkippedSlot>,
-) -> Result<(), BundleError> {
-    if verdicts.is_empty() {
-        return Ok(());
-    }
-    let _ = cas_update_list(store, 8, move |cur| {
-        let mut next = cur.cloned().unwrap_or_default();
-        let mut added = false;
-        for v in &verdicts {
-            if next
-                .skipped
-                .iter()
-                .any(|k| k.strategy == v.strategy && k.slot == v.slot && k.base_id == v.base_id)
-            {
-                continue;
-            }
-            next.skipped.push(v.clone());
-            added = true;
-        }
-        if !added {
-            return Ok(None);
-        }
-        if next.skipped.len() > SKIPPED_KEPT {
-            next.skipped.sort_by_key(|k| k.slot);
-            let drop = next.skipped.len() - SKIPPED_KEPT;
-            next.skipped.drain(0..drop);
-        }
-        next.updated_at = Some(time::now());
-        Ok(Some(next))
-    })
-    .await?;
-    Ok(())
-}
-
-/// CAS read-modify-write loop on `bundles/list.pb`.
-///
-/// `f` receives `None` when the list is absent, `Some(&list)` when present.
-/// Returning `None` from `f` aborts the update with `Ok(None)`.
-pub async fn cas_update_list<F>(
-    store: &Prefixed,
-    max_retries: u32,
-    mut f: F,
-) -> Result<Option<(Version, BundleList)>, BundleError>
-where
-    F: FnMut(Option<&BundleList>) -> Result<Option<BundleList>, BundleError>,
-{
-    let key = keys::BUNDLE_LIST;
-    for attempt in 0..max_retries {
-        let current = store.get_bytes(key).await?;
-        match current {
-            None => match f(None)? {
-                None => return Ok(None),
-                Some(new_list) => {
-                    let body = new_list.encode_to_vec();
-                    match store
-                        .put(key, PutBody::from(body), PutOptions::from(PutMode::Create))
-                        .await
-                    {
-                        Ok(meta) => return Ok(Some((meta.version, new_list))),
-                        Err(StoreError::PreconditionFailed { .. }) => {
-                            debug!(attempt, "cas retry: list created by another writer");
-                            continue;
-                        }
-                        Err(e) => return Err(e.into()),
-                    }
-                }
-            },
-            Some((meta, data)) => {
-                let list = BundleList::decode(data.as_ref())?;
-                match f(Some(&list))? {
-                    None => return Ok(None),
-                    Some(new_list) => {
-                        let body = new_list.encode_to_vec();
-                        match store
-                            .put(
-                                key,
-                                PutBody::from(body),
-                                PutOptions::from(PutMode::Update(meta.version.clone())),
-                            )
-                            .await
-                        {
-                            Ok(new_meta) => return Ok(Some((new_meta.version, new_list))),
-                            Err(StoreError::PreconditionFailed { .. }) => {
-                                debug!(attempt, "cas retry: list changed by another writer");
-                                continue;
-                            }
-                            Err(e) => return Err(e.into()),
-                        }
-                    }
-                }
-            }
-        }
-    }
-    Err(BundleError::RetriesExhausted)
-}
-
-// ---------------------------------------------------------------------------
-// ---------------------------------------------------------------------------
-// Leasing
-// ---------------------------------------------------------------------------
-
-/// A held bundle-build lease. Drop is best-effort release; call [`release`]
-/// for an awaited release.
-pub struct LeaseGuard {
-    store: Prefixed,
-    key: String,
-    version: Version,
-    released: bool,
-}
-
-impl Drop for LeaseGuard {
-    /// Best-effort release when the holder is dropped without `release()`
-    /// (task cancelled by an instance shutdown): the next maintainer must not
-    /// wait a TTL for a lease nobody holds.
-    fn drop(&mut self) {
-        if self.released {
-            return;
-        }
-        let store = self.store.clone();
-        let key = self.key.clone();
-        let version = self.version.clone();
-        if let Ok(h) = tokio::runtime::Handle::try_current() {
-            h.spawn(async move {
-                let _ = store.delete(&key, Some(version)).await;
-            });
-        }
-    }
-}
-
-impl LeaseGuard {
-    /// Release the lease (CAS delete).
-    pub async fn release(mut self) -> Result<(), BundleError> {
-        self.released = true;
-        match self
-            .store
-            .delete(&self.key, Some(self.version.clone()))
-            .await
-        {
-            Ok(()) | Err(StoreError::PreconditionFailed { .. } | StoreError::NotFound { .. }) => {
-                Ok(())
-            }
-            Err(e) => Err(e.into()),
-        }
-    }
-
-    /// CAS-extend the lease's `expires_at` (heartbeat).
-    pub async fn heartbeat(&mut self, ttl: Duration) -> Result<(), BundleError> {
-        let now = SystemTime::now();
-        let expires = now + ttl;
-        let lease = Lease {
-            holder: instance_id().to_string(),
-            purpose: "bundle".into(),
-            acquired_at: Some(time::from_system(now)),
-            expires_at: Some(time::from_system(expires)),
-            epoch: 1,
-        };
-        match self
-            .store
-            .put(
-                &self.key,
-                PutBody::from(lease.encode_to_vec()),
-                PutOptions::from(PutMode::Update(self.version.clone())),
-            )
-            .await
-        {
-            Ok(meta) => {
-                self.version = meta.version;
-                Ok(())
-            }
-            Err(e) => Err(e.into()),
-        }
-    }
-}
-
-/// Try to acquire a lease at `leases/bundle-<strategy>.pb`.
-///
-/// Returns `Ok(Some(guard))` if acquired, `Ok(None)` if held by another
-/// non-expired holder.
-pub async fn try_acquire_lease(
-    store: &Prefixed,
-    strategy: &str,
-    ttl: Duration,
-) -> Result<Option<LeaseGuard>, BundleError> {
-    let key = format!("{}bundle-{strategy}.pb", keys::LEASES_DIR);
-    let now = SystemTime::now();
-    let expires = now + ttl;
-    let lease = Lease {
-        holder: instance_id().to_string(),
-        purpose: format!("bundle-{strategy}"),
-        acquired_at: Some(time::from_system(now)),
-        expires_at: Some(time::from_system(expires)),
-        epoch: 0,
-    };
-    let body = lease.encode_to_vec();
-
-    // Try create-if-absent.
-    match store
-        .put(
-            &key,
-            PutBody::from(body.clone()),
-            PutOptions::from(PutMode::Create),
-        )
-        .await
-    {
-        Ok(meta) => {
-            return Ok(Some(LeaseGuard {
-                store: store.clone(),
-                key,
-                version: meta.version,
-                released: false,
-            }));
-        }
-        Err(StoreError::PreconditionFailed { .. }) => {}
-        Err(e) => return Err(e.into()),
-    }
-
-    // Already exists — check if expired and try to steal.
-    match store.get_bytes(&key).await? {
-        Some((meta, data)) => {
-            let existing = Lease::decode(data.as_ref())?;
-            let expired = existing
-                .expires_at
-                .as_ref()
-                .is_none_or(|t| time::to_system(t) <= now);
-            if !expired {
-                return Ok(None);
-            }
-            match store
-                .put(
-                    &key,
-                    PutBody::from(body),
-                    PutOptions::from(PutMode::Update(meta.version.clone())),
-                )
-                .await
-            {
-                Ok(new_meta) => Ok(Some(LeaseGuard {
-                    store: store.clone(),
-                    key,
-                    version: new_meta.version,
-                    released: false,
-                })),
-                Err(StoreError::PreconditionFailed { .. }) => Ok(None),
-                Err(e) => Err(e.into()),
-            }
-        }
-        None => match store
-            .put(&key, PutBody::from(body), PutOptions::from(PutMode::Create))
-            .await
-        {
-            Ok(meta) => Ok(Some(LeaseGuard {
-                store: store.clone(),
-                key,
-                version: meta.version,
-                released: false,
-            })),
-            Err(StoreError::PreconditionFailed { .. }) => Ok(None),
-            Err(e) => Err(e.into()),
-        },
-    }
-}
-
-/// Manually hold a lease for a strategy (prevents builds). Used in tests
-/// to verify lease skipping.
-pub async fn hold_lease(
-    store: &Prefixed,
-    strategy: &str,
-    holder: &str,
-    ttl: Duration,
-) -> Result<Version, BundleError> {
-    let key = format!("{}bundle-{strategy}.pb", keys::LEASES_DIR);
-    let now = SystemTime::now();
-    let lease = Lease {
-        holder: holder.to_string(),
-        purpose: format!("bundle-{strategy}"),
-        acquired_at: Some(time::from_system(now)),
-        expires_at: Some(time::from_system(now + ttl)),
-        epoch: 0,
-    };
-    let meta = store
-        .put(
-            &key,
-            PutBody::from(lease.encode_to_vec()),
-            PutOptions::from(PutMode::Create),
-        )
-        .await
-        .map_err(|e| {
-            if e.is_precondition_failed() {
-                BundleError::Other("lease already held".into())
-            } else {
-                BundleError::from(e)
-            }
-        })?;
-    Ok(meta.version)
-}
-
-// ---------------------------------------------------------------------------
-// Full build: create bundle, upload, return entry
-// ---------------------------------------------------------------------------
-
-/// Build a bundle from `local`, upload it to `store`, and return the
-/// [`BundleEntry`]. Does NOT update `bundles/list.pb` — the caller does that
-/// via [`cas_update_list`] so pruning is atomic with the append.
-/// What a bundle is cut for: a calendar slot with the ref state as of that
-/// slot (`snapshot`, WAL `seq`), or "now" (legacy: token = max(prev+1, now)).
-pub struct Cut {
-    /// Slot epoch seconds = `creation_token` (0 = no slot: token from `now`).
-    pub slot: u64,
-    /// Ref state to cut from (None = the local copy's current refs).
-    pub snapshot: Option<RefSnapshotData>,
-    /// WAL seq the snapshot corresponds to.
-    pub seq: u64,
-}
-
-#[allow(clippy::too_many_arguments)]
-pub async fn build_and_upload(
-    local: &LocalRepo,
-    engine: &crate::BundleEngine,
-    store: &Prefixed,
-    strategy_name: &str,
-    kind: BundleKind,
-    ref_patterns: &[String],
-    prerequisites: &[String],
-    base_id: &str,
-    cut: &Cut,
-    prev_token: u64,
-    now: SystemTime,
-    filter: Option<&str>,
-) -> Result<BundleEntry, BundleError> {
-    // 1. Resolve refs (tips): the slot's ref state, or the local copy's.
-    let snap = match &cut.snapshot {
-        Some(s) => s.clone(),
-        None => local.refs().map_err(BundleError::Git)?,
-    };
-    let (ref_names, tips) = filter_refs(&snap, ref_patterns);
-    // A tip whose object this copy cannot resolve (a ref published ahead of a
-    // pack this instance has not installed, or a dangling ref in the snapshot)
-    // must not fail the whole build: bundle what resolves, report the rest.
-    let mut resolvable = std::collections::HashSet::new();
-    let mut dangling = Vec::new();
-    for t in &tips {
-        match walgit_git::gix_hash::ObjectId::from_hex(t.oid.as_bytes()) {
-            Ok(oid) if local.has_object(&oid) => {
-                resolvable.insert(t.name.clone());
-            }
-            _ => dangling.push(format!("{} -> {}", t.name, t.oid)),
-        }
-    }
-    if !dangling.is_empty() {
-        warn!(strategy = strategy_name, count = dangling.len(), refs = ?dangling, "bundle: skipping refs whose tips are not in the local copy");
-    }
-    let ref_names: Vec<String> = ref_names
-        .into_iter()
-        .filter(|n| resolvable.contains(n))
-        .collect();
-    let tips: Vec<Ref> = tips
-        .into_iter()
-        .filter(|t| resolvable.contains(&t.name))
-        .collect();
-    if ref_names.is_empty() {
-        return Err(BundleError::NoRefs);
-    }
-
-    // 2. Create bundle file in a tempdir.
-    let tmp = tempfile::tempdir().map_err(|e| BundleError::Io(e.to_string()))?;
-    let bundle_path = tmp.path().join("bundle.bundle");
-
-    let engine_name = match engine {
-        crate::BundleEngine::Gix { .. } => "gix",
-        crate::BundleEngine::Git => "git",
-    };
-    let build_span = tracing::info_span!(
-        "bundle.build",
-        strategy = strategy_name,
-        kind = match kind {
-            BundleKind::Full => "full",
-            BundleKind::Incremental => "incremental",
-        },
-        slot = cut.slot,
-        seq = cut.seq,
-        base = base_id,
-        refs = ref_names.len(),
-        prerequisites = prerequisites.len(),
-        engine = engine_name,
-        bytes = tracing::field::Empty,
-        outcome = tracing::field::Empty
-    );
-    let t_build = std::time::Instant::now();
-    let size = match create_bundle(
-        local,
-        engine,
-        &bundle_path,
-        &ref_names,
-        &tips,
-        prerequisites,
-        filter,
-    )
-    .instrument(build_span.clone())
-    .await
-    {
-        Ok(s) => {
-            build_span.record("bytes", s);
-            build_span.record("outcome", "ok");
-            metrics::histogram!("walgit_bundle_build_seconds", "strategy" => strategy_name.to_string(), "kind" => match kind { BundleKind::Full => "full", BundleKind::Incremental => "incremental" }).record(t_build.elapsed().as_secs_f64());
-            metrics::histogram!("walgit_bundle_build_bytes", "strategy" => strategy_name.to_string()).record(metric_u64(s));
-            s
-        }
-        Err(BundleError::Git(GitError::Subprocess { stderr, .. }))
-            if stderr.contains("empty bundle") =>
-        {
-            build_span.record("outcome", "empty");
-            return Err(BundleError::NoNewObjects);
-        }
-        Err(e) => {
-            build_span.record("outcome", "error");
-            return Err(e);
-        }
-    };
-
-    // 3. Checksum (streamed; a bundle can be GBs — never buffer it whole).
-    let checksum = {
-        let p = bundle_path.clone();
-        tokio::task::spawn_blocking(move || bundle_checksum_file(&p))
-            .await
-            .map_err(|e| BundleError::Io(e.to_string()))?
-            .map_err(|e| BundleError::Io(e.to_string()))?
-    };
-
-    // 4. Generate key and upload (immutable, create-if-absent).
-    let key = bundle_key(strategy_name, now, &checksum);
-    let kind_str = match kind {
-        BundleKind::Full => "full",
-        BundleKind::Incremental => "incremental",
-    };
-    let creation_token = if cut.slot > 0 {
-        cut.slot
-    } else {
-        (prev_token + 1).max(crate::schedule::unix_now(now))
-    };
-    let bundle_id = format!("{strategy_name}-{creation_token}");
-
-    let publish_span = tracing::info_span!("bundle.publish", strategy = strategy_name, key = %key, bytes = size, token = creation_token, slot = cut.slot);
-    let version = match store
-        .put(
-            &key,
-            PutBody::File(bundle_path.clone()),
-            PutOptions {
-                mode: PutMode::Create,
-                immutable: true,
-                content_type: Some("application/x-git-bundle"),
-            },
-        )
-        .instrument(publish_span)
-        .await
-    {
-        Ok(meta) => meta.version,
-        Err(StoreError::PreconditionFailed { .. }) => {
-            // Already uploaded (idempotent retry) — fetch existing version.
-            store
-                .head(&key)
-                .await?
-                .ok_or_else(|| BundleError::Other(format!("bundle vanished: {key}")))?
-                .version
-        }
-        Err(e) => return Err(e.into()),
-    };
-
-    // 5. Build the entry.
-    let entry = BundleEntry {
-        id: bundle_id,
-        key,
-        strategy: strategy_name.to_string(),
-        kind: kind_str.to_string(),
-        creation_token,
-        slot: cut.slot,
-        seq: cut.seq,
-        size,
-        base_id: base_id.to_string(),
-        filter: filter.unwrap_or("").to_string(),
-        created_at: Some(time::from_system(now)),
-        version: version.to_string(),
-        tips,
-    };
-
-    debug!(strategy = strategy_name, kind = kind_str, key = %entry.key, slot = cut.slot, "bundle uploaded");
-    Ok(entry)
-}
-
-/// Metrics use `f64`; values beyond its exact integer range are still useful as
-/// approximate byte counts.
-#[allow(clippy::cast_precision_loss)]
-fn metric_u64(value: u64) -> f64 {
-    value as f64
-}
-
-/// Find the most recent bundle entry for `strategy` in `list`.
-pub fn last_for_strategy<'a>(list: &'a BundleList, strategy: &str) -> Option<&'a BundleEntry> {
-    list.bundles
-        .iter()
-        .filter(|b| b.strategy == strategy)
-        .max_by_key(|b| b.creation_token)
-}
-
-/// The newest built incremental of `strategy` on `base_id` at or before
-/// `slot` whose tip set equals `tips` (name + oid) — i.e. cutting `slot` would
-/// reproduce it byte for byte. Idle nights/weekends otherwise cut 23–48
-/// identical 315 MB hourlies a day on a large repository (2026-08-21: 08:00/09:00/10:00).
-/// Clients are unaffected: git stops at the first bundle whose prerequisites
-/// it has, and a stale `fetch.bundleCreationToken` simply finds nothing newer.
-pub fn unchanged_since<'a>(
-    list: &'a BundleList,
-    strategy: &str,
-    base_id: &str,
-    slot: u64,
-    tips: &[Ref],
-) -> Option<&'a BundleEntry> {
-    let prev = list
-        .bundles
-        .iter()
-        .filter(|b| b.strategy == strategy && b.base_id == base_id && b.slot > 0 && b.slot <= slot)
-        .max_by_key(|b| b.slot)?;
-    let mut a: Vec<(&str, &str)> = prev
-        .tips
-        .iter()
-        .map(|t| (t.name.as_str(), t.oid.as_str()))
-        .collect();
-    let mut b: Vec<(&str, &str)> = tips
-        .iter()
-        .map(|t| (t.name.as_str(), t.oid.as_str()))
-        .collect();
-    a.sort_unstable();
-    b.sort_unstable();
-    (a == b).then_some(prev)
-}
-
-/// Max `creation_token` across all entries in `list` (0 if empty).
-pub fn max_creation_token(list: &BundleList) -> u64 {
-    list.bundles
-        .iter()
-        .map(|b| b.creation_token)
-        .max()
-        .unwrap_or(0)
-}
-
-/// Delete objects for pruned bundle keys (best-effort, after CAS succeeds).
-pub async fn delete_pruned(store: &Prefixed, keys_to_delete: &[String]) {
-    let span = tracing::info_span!("bundle.retention", pruned = keys_to_delete.len());
-    delete_pruned_inner(store, keys_to_delete)
-        .instrument(span)
-        .await;
-}
-
-async fn delete_pruned_inner(store: &Prefixed, keys_to_delete: &[String]) {
-    for key in keys_to_delete {
-        if let Err(e) = store.delete(key, None).await {
-            warn!(key, error = %e, "failed to delete pruned bundle object");
-        }
-    }
-}
-
-/// Compute the set of keys present in `old` but absent from `new` — i.e.,
-/// entries that were pruned during the CAS update.
-pub fn pruned_diff(old: &BundleList, new: &BundleList) -> Vec<String> {
-    let new_keys: HashSet<&str> = new.bundles.iter().map(|b| b.key.as_str()).collect();
-    old.bundles
-        .iter()
-        .map(|b| b.key.clone())
-        .filter(|k| !new_keys.contains(k.as_str()))
-        .collect()
-}
-
-// ---------------------------------------------------------------------------
-// Full bundle = header ∘ base pack via server-side compose (no disk, no
-// index-pack, no bytes through the builder). Used by `walgit import --direct`
-// and the weekly large-repository job (`walgit bundle compose`): the base pack built at
-// WAL seq S contains every object reachable from the refs at S, so the header
-// must carry the refs *at S* (the checkpoint's snapshot), never today's.
-// ---------------------------------------------------------------------------
-
-/// Bundle header bytes + the tips it lists (HEAD, refs/heads/*, refs/tags/*).
-/// Bundle header prelude: v2 for sha1 without a filter, v3 with capabilities
-/// otherwise (`@object-format=sha256`, `@filter=blob:none` — git unbundles a
-/// filtered bundle with `index-pack --promisor=from-bundle`).
-pub fn bundle_prelude(format: walgit_git::ObjectFormat, filter: Option<&str>) -> Vec<u8> {
-    let sha256 = matches!(format, walgit_git::ObjectFormat::Sha256);
-    if !sha256 && filter.is_none() {
-        return b"# v2 git bundle\n".to_vec();
-    }
-    let mut h = b"# v3 git bundle\n".to_vec();
-    if sha256 {
-        h.extend_from_slice(b"@object-format=sha256\n");
-    }
-    if let Some(f) = filter {
-        h.extend_from_slice(format!("@filter={f}\n").as_bytes());
-    }
-    h
-}
-
-pub fn full_bundle_header(
-    snap: &walgit_proto::v1::RefSnapshot,
-    format: walgit_git::ObjectFormat,
-    filter: Option<&str>,
-) -> (Vec<u8>, Vec<Ref>) {
-    let mut h = bundle_prelude(format, filter);
-    let mut tips = Vec::new();
-    if let Some(head) = snap.refs.iter().find(|r| r.name == snap.head_target) {
-        h.extend_from_slice(format!("{} HEAD\n", head.oid).as_bytes());
-        tips.push(Ref {
-            name: "HEAD".into(),
-            oid: head.oid.clone(),
-            peeled: String::new(),
-        });
-    }
-    for r in &snap.refs {
-        if r.name.starts_with("refs/heads/") || r.name.starts_with("refs/tags/") {
-            h.extend_from_slice(format!("{} {}\n", r.oid, r.name).as_bytes());
-            tips.push(r.clone());
-        }
-    }
-    h.push(b'\n');
-    (h, tips)
-}
-
-/// Publish `bundles/<strategy>/<stamp>-<pack>.bundle` = header ∘ `wal/<pack>.pack`
-/// by compose (falls back to streaming header + `pack_path` when the store
-/// cannot compose; then `pack_path` must be a local file) and return the entry
-/// (not yet in the list — see [`cas_update_list`]).
-pub async fn compose_full(
-    store: &Prefixed,
-    pack_checksum: &str,
-    pack_size: u64,
-    pack_path: Option<&Path>,
-    snap: &walgit_proto::v1::RefSnapshot,
-    format: walgit_git::ObjectFormat,
-    strategy: &str,
-    seq: u64,
-    prev_token: u64,
-    now: SystemTime,
-    slot: u64,
-    filter: Option<&str>,
-) -> Result<BundleEntry, BundleError> {
-    let (header, tips) = full_bundle_header(snap, format, filter);
-    if tips.is_empty() {
-        return Err(BundleError::NoRefs);
-    }
-    let span = tracing::info_span!(
-        "bundle.compose",
-        strategy,
-        slot,
-        seq,
-        base_checksum = pack_checksum,
-        bytes = pack_size,
-        refs = tips.len()
-    );
-    compose_full_inner(
-        store,
-        pack_checksum,
-        pack_size,
-        pack_path,
-        header,
-        tips,
-        strategy,
-        seq,
-        prev_token,
-        now,
-        slot,
-        filter,
-    )
-    .instrument(span)
-    .await
-}
-
-#[allow(clippy::too_many_arguments)]
-async fn compose_full_inner(
-    store: &Prefixed,
-    pack_checksum: &str,
-    pack_size: u64,
-    pack_path: Option<&Path>,
-    header: Vec<u8>,
-    tips: Vec<Ref>,
-    strategy: &str,
-    seq: u64,
-    prev_token: u64,
-    now: SystemTime,
-    slot: u64,
-    filter: Option<&str>,
-) -> Result<BundleEntry, BundleError> {
-    let creation_token = if slot > 0 {
-        slot
-    } else {
-        (prev_token + 1).max(crate::schedule::unix_now(now))
-    };
-    let key = format!(
-        "bundles/{strategy}/{}-{pack_checksum}.bundle",
-        rfc3339_compact(now)
-    );
-    let pack_key = keys::pack_key(pack_checksum);
-    let opts = PutOptions {
-        mode: PutMode::Overwrite,
-        immutable: true,
-        content_type: Some("application/x-git-bundle"),
-    };
-    let meta = if store.supports_compose() {
-        let hdr_key = format!("{key}.hdr");
-        store
-            .put(
-                &hdr_key,
-                PutBody::Bytes(header.clone().into()),
-                PutOptions::from(PutMode::Overwrite),
-            )
-            .await?;
-        let m = store
-            .compose(&key, &[hdr_key.clone(), pack_key], opts)
-            .await?;
-        let _ = store.delete(&hdr_key, None).await;
-        m
-    } else {
-        let Some(path) = pack_path else {
-            return Err(BundleError::Other(
-                "store cannot compose and the base pack is not a local file".into(),
-            ));
-        };
-        let len = header.len() as u64 + pack_size;
-        let stream = futures::StreamExt::boxed(futures::StreamExt::chain(
-            walgit_store::util::once(header.clone().into()),
-            walgit_store::util::file_stream(path.to_path_buf(), None, 1024 * 1024),
-        ));
-        store
-            .put(&key, PutBody::Stream { len, stream }, opts)
-            .await?
-    };
-    Ok(BundleEntry {
-        id: format!("{strategy}-{creation_token}"),
-        key,
-        strategy: strategy.to_string(),
-        kind: "full".into(),
-        creation_token,
-        slot: if slot > 0 { slot } else { 0 },
-        seq,
-        size: meta.size,
-        base_id: String::new(),
-        filter: filter.unwrap_or("").to_string(),
-        created_at: Some(time::from_system(now)),
-        version: meta.version.to_string(),
-        tips,
-    })
-}
-
-/// Commits reachable from `tips` and not from `prerequisites`
-/// (`git rev-list --count`): the minimum-size gate's measure. Commits/trees are
-/// local on every host (history pack / small packs) and the commit-graph makes
-/// this a graph walk, never a pack read.
-pub(crate) async fn count_commits(
-    local: &LocalRepo,
-    tips: &[String],
-    prerequisites: &[String],
-) -> Result<u64, BundleError> {
-    if tips.is_empty() {
-        return Ok(0);
-    }
-    let repo_path = local.path();
-    let mut cmd = tokio::process::Command::new("git");
-    cmd.arg("rev-list").arg("--count");
-    for t in tips {
-        cmd.arg(t);
-    }
-    cmd.arg("--not");
-    for p in prerequisites {
-        cmd.arg(p);
-    }
-    cmd.current_dir(repo_path).env("GIT_DIR", repo_path);
-    let out = cmd
-        .output()
-        .await
-        .map_err(|e| BundleError::Io(e.to_string()))?;
-    if !out.status.success() {
-        return Err(BundleError::Git(GitError::Subprocess {
-            cmd: "git rev-list --count".into(),
-            status: out.status.code(),
-            stderr: String::from_utf8_lossy(&out.stderr).to_string(),
-        }));
-    }
-    Ok(String::from_utf8_lossy(&out.stdout)
-        .trim()
-        .parse()
-        .unwrap_or(0))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn rfc3339_compact_format() {
-        let t = std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_700_000_000);
-        assert_eq!(rfc3339_compact(t), "20231114T221320Z");
-    }
-
-    #[test]
-    fn checksum_deterministic() {
-        let data = b"hello world";
-        let c1 = bundle_checksum(data);
-        let c2 = bundle_checksum(data);
-        assert_eq!(c1, c2);
-        assert_eq!(c1.len(), 40);
-    }
-
-    #[test]
-    fn bundle_key_format() {
-        let t = std::time::UNIX_EPOCH + std::time::Duration::from_secs(1_700_000_000);
-        assert_eq!(
-            bundle_key("weekly", t, "abc123"),
-            "bundles/weekly/20231114T221320Z-abc123.bundle"
-        );
-    }
-
-    #[test]
-    fn pattern_matching() {
-        assert!(matches_pattern("refs/heads/main", "refs/heads/*"));
-        assert!(matches_pattern("refs/heads/feature/x", "refs/heads/*"));
-        assert!(!matches_pattern("refs/tags/v1", "refs/heads/*"));
-        assert!(matches_pattern("HEAD", "HEAD"));
-        assert!(!matches_pattern("refs/heads/main", "HEAD"));
-        assert!(matches_pattern("refs/heads/main", "refs/heads/main"));
-        assert!(!matches_pattern("refs/heads/dev", "refs/heads/main"));
-    }
-}
diff --git a/crates/walgit-bundle/src/render.rs b/crates/walgit-bundle/src/render.rs
deleted file mode 100644
index 84aa24c..0000000
--- a/crates/walgit-bundle/src/render.rs
+++ /dev/null
@@ -1,334 +0,0 @@
-#![allow(clippy::too_many_arguments)]
-//! Render the bundle list in git's bundle-list config format and protocol v2
-//! key=value lines.
-//!
-//! See: <https://git-scm.com/docs/bundle-uri> and
-//!      <https://git-scm.com/docs/gitprotocol-v2> (bundle-uri command).
-
-use std::time::Duration;
-
-use walgit_config::{BundleServe, BundlesConfig};
-use walgit_proto::v1::{BundleEntry, BundleList};
-use walgit_store::{ObjectStore, Prefixed};
-
-use crate::BundleError;
-
-/// Extract the filename from a bundle key like
-/// `bundles/weekly/20231114T221320Z-abc.bundle` → `20231114T221320Z-abc.bundle`.
-fn filename_of(key: &str) -> &str {
-    key.rsplit('/').next().unwrap_or(key)
-}
-
-/// Build the URI for a single bundle entry.
-///
-/// * **Proxy**: `{base_url}/{owner}/{repo}/bundles/{strategy}/{filename}`
-/// * **`SignedUrl`**: `store.signed_get_url(key, ttl)`, falling back to Proxy
-///   if the store doesn't support signed URLs.
-pub async fn bundle_uri(
-    entry: &BundleEntry,
-    owner: &str,
-    repo: &str,
-    base_url: &str,
-    serve_via: BundleServe,
-    store: &Prefixed,
-    signed_ttl: Duration,
-) -> Result<String, BundleError> {
-    match serve_via {
-        BundleServe::SignedUrl => match store.signed_get_url(&entry.key, signed_ttl).await {
-            Ok(Some(url)) => Ok(url),
-            Ok(None) => Ok(proxy_uri(entry, owner, repo, base_url)),
-            // Signing may be unavailable or denied by the store. A listing must
-            // never fail on that: fall back to the authenticated proxy URI and
-            // say so once per repository.
-            Err(e) => {
-                warn_signing_once(owner, repo, &e);
-                Ok(proxy_uri(entry, owner, repo, base_url))
-            }
-        },
-        BundleServe::Proxy => Ok(proxy_uri(entry, owner, repo, base_url)),
-    }
-}
-
-static SIGNING_WARNED: std::sync::LazyLock<std::sync::Mutex<std::collections::HashSet<String>>> =
-    std::sync::LazyLock::new(|| std::sync::Mutex::new(std::collections::HashSet::new()));
-
-fn warn_signing_once(owner: &str, repo: &str, e: &dyn std::fmt::Display) {
-    let key = format!("{owner}/{repo}");
-    if SIGNING_WARNED
-        .lock()
-        .unwrap_or_else(std::sync::PoisonError::into_inner)
-        .insert(key.clone())
-    {
-        tracing::warn!(repo = %key, error = %e, "signed bundle URL failed; serving proxy URIs instead (check the store signing permissions)");
-    }
-}
-
-/// Relative path of a bundle on this host: `/{owner}/{repo}/bundles/{strategy}/{file}`.
-pub fn bundle_path(entry: &BundleEntry, owner: &str, repo: &str) -> String {
-    format!(
-        "/{owner}/{repo}/bundles/{}/{}",
-        entry.strategy,
-        filename_of(&entry.key)
-    )
-}
-
-/// Construct the proxy-style URI.
-fn proxy_uri(entry: &BundleEntry, owner: &str, repo: &str, base_url: &str) -> String {
-    let base = base_url.trim_end_matches('/');
-    let filename = filename_of(&entry.key);
-    format!(
-        "{base}/{owner}/{repo}/bundles/{}/{}",
-        entry.strategy, filename
-    )
-}
-
-/// Render the bundle list as git config text (bundle-list format).
-///
-/// ```ini
-/// [bundle]
-///     version = 1
-///     mode = all
-///     heuristic = creationToken
-///
-/// [bundle "<id>"]
-///     uri = <uri>
-///     creationToken = <token>
-/// ```
-pub async fn render_list_text(
-    list: &BundleList,
-    owner: &str,
-    repo: &str,
-    base_url: &str,
-    cfg: &BundlesConfig,
-    store: &Prefixed,
-    filter: Option<&str>,
-    fulls: bool,
-) -> Result<String, BundleError> {
-    let mut out = String::new();
-    out.push_str("[bundle]\n");
-    out.push_str("    version = 1\n");
-    out.push_str("    mode = all\n");
-    out.push_str("    heuristic = creationToken\n");
-
-    // One family per list: the entries whose filter equals the requested one
-    // ("" = the unfiltered chain). Sorted by creation_token so git processes
-    // them in order. `fulls = false` is the catch-up list (`bundles/catchup`, what the recipes put
-    // in `fetch.bundleURI`): a client that fetches has history, it only ever needs the incremental
-    // links above what it has — and git's creationToken walk would otherwise download every full
-    // newer than its token (32 GB from a large repository on the first fetch after Sunday; rig, 2026-08-22).
-    let want = filter.unwrap_or("");
-    let mut bundles: Vec<&BundleEntry> = list
-        .bundles
-        .iter()
-        .filter(|b| b.filter == want || (filter.is_none() && cfg.advertise_filtered))
-        .filter(|b| fulls || !b.base_id.is_empty())
-        .collect();
-    bundles.sort_by_key(|b| b.creation_token);
-
-    for entry in &bundles {
-        let uri = bundle_uri(
-            entry,
-            owner,
-            repo,
-            base_url,
-            serve_via_for(cfg, owner, repo),
-            store,
-            cfg.signed_url_ttl,
-        )
-        .await?;
-        out.push('\n');
-        {
-            let _ =
-                std::fmt::Write::write_fmt(&mut out, format_args!("[bundle \"{}\"]\n", entry.id));
-        };
-        {
-            let _ = std::fmt::Write::write_fmt(&mut out, format_args!("    uri = {uri}\n"));
-        };
-        {
-            let _ = std::fmt::Write::write_fmt(
-                &mut out,
-                format_args!("    creationToken = {}\n", entry.creation_token),
-            );
-        };
-        if !entry.filter.is_empty() {
-            {
-                let _ = std::fmt::Write::write_fmt(
-                    &mut out,
-                    format_args!("    filter = {}\n", entry.filter),
-                );
-            };
-        }
-    }
-
-    Ok(out)
-}
-
-/// Render the bundle list as protocol v2 key=value lines.
-///
-/// ```text
-/// bundle.version=1
-/// bundle.mode=all
-/// bundle.heuristic=creationToken
-/// bundle.<id>.uri=<uri>
-/// bundle.<id>.creationtoken=<token>
-/// ```
-///
-/// Subkeys are lowercase: git parses protocol lines with `bundle_list_update`,
-/// which `strcmp`s the subkey against `"creationtoken"` (config files are
-/// case-insensitive, the protocol is not; `git upload-pack` emits config keys
-/// lowercased). A camelCase key is silently ignored -> creationToken 0 ->
-/// "failed to fetch advertised bundles".
-pub async fn protocol_v2_lines(
-    list: &BundleList,
-    owner: &str,
-    repo: &str,
-    base_url: &str,
-    cfg: &BundlesConfig,
-    store: &Prefixed,
-) -> Result<Vec<String>, BundleError> {
-    let mut lines = vec![
-        "bundle.version=1".to_string(),
-        "bundle.mode=all".to_string(),
-        "bundle.heuristic=creationToken".to_string(),
-    ];
-
-    // The protocol-advertised list is the UNFILTERED chain only: git applies
-    // no filter matching, and a full clone must never swallow a blobless bundle.
-    let mut bundles: Vec<&BundleEntry> = list
-        .bundles
-        .iter()
-        .filter(|b| b.filter.is_empty() || cfg.advertise_filtered)
-        .collect();
-    bundles.sort_by_key(|b| b.creation_token);
-
-    for entry in &bundles {
-        let uri = bundle_uri(
-            entry,
-            owner,
-            repo,
-            base_url,
-            serve_via_for(cfg, owner, repo),
-            store,
-            cfg.signed_url_ttl,
-        )
-        .await?;
-        lines.push(format!("bundle.{}.uri={}", entry.id, uri));
-        lines.push(format!(
-            "bundle.{}.creationtoken={}",
-            entry.id, entry.creation_token
-        ));
-        if !entry.filter.is_empty() {
-            lines.push(format!("bundle.{}.filter={}", entry.id, entry.filter));
-        }
-    }
-
-    Ok(lines)
-}
-
-/// `serve_via` for one repository (`bundles.signed_url_for` overrides).
-fn serve_via_for(cfg: &walgit_config::BundlesConfig, owner: &str, repo: &str) -> BundleServe {
-    if walgit_config::repo_listed(&cfg.signed_url_for, owner, repo) {
-        BundleServe::SignedUrl
-    } else {
-        cfg.serve_via
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use walgit_proto::v1::BundleEntry;
-
-    fn make_entry(id: &str, strategy: &str, token: u64) -> BundleEntry {
-        BundleEntry {
-            id: id.into(),
-            key: format!("bundles/{strategy}/{id}.bundle"),
-            strategy: strategy.into(),
-            kind: "full".into(),
-            filter: String::new(),
-            creation_token: token,
-            slot: 0,
-            seq: 1,
-            size: 100,
-            base_id: String::new(),
-            created_at: None,
-            version: "v1".into(),
-            tips: vec![],
-        }
-    }
-
-    fn make_cfg() -> BundlesConfig {
-        BundlesConfig::default()
-    }
-
-    fn make_store() -> Prefixed {
-        Prefixed::new(
-            std::sync::Arc::new(walgit_store::memory::MemoryStore::new()) as walgit_store::DynStore,
-            "repos/test/repo/",
-        )
-    }
-
-    #[tokio::test]
-    async fn render_list_config_format() {
-        let list = BundleList {
-            mode: "all".into(),
-            heuristic: "creationToken".into(),
-            bundles: vec![
-                make_entry("weekly-100", "weekly", 100),
-                make_entry("daily-200", "daily", 200),
-            ],
-            ..Default::default()
-        };
-        let cfg = make_cfg();
-        let store = make_store();
-        let text = render_list_text(
-            &list,
-            "test",
-            "repo",
-            "https://example.com",
-            &cfg,
-            &store,
-            None,
-            true,
-        )
-        .await
-        .unwrap();
-        assert!(text.contains("[bundle]"));
-        assert!(text.contains("version = 1"));
-        assert!(text.contains("mode = all"));
-        assert!(text.contains("heuristic = creationToken"));
-        assert!(text.contains("[bundle \"weekly-100\"]"));
-        assert!(
-            text.contains("uri = https://example.com/test/repo/bundles/weekly/weekly-100.bundle")
-        );
-        assert!(text.contains("creationToken = 100"));
-        assert!(text.contains("[bundle \"daily-200\"]"));
-        assert!(text.contains("creationToken = 200"));
-    }
-
-    #[tokio::test]
-    async fn protocol_v2_format() {
-        let list = BundleList {
-            mode: "all".into(),
-            heuristic: "creationToken".into(),
-            bundles: vec![make_entry("weekly-100", "weekly", 100)],
-            ..Default::default()
-        };
-        let cfg = make_cfg();
-        let store = make_store();
-        let lines = protocol_v2_lines(&list, "test", "repo", "https://example.com", &cfg, &store)
-            .await
-            .unwrap();
-        assert!(lines.contains(&"bundle.version=1".to_string()));
-        assert!(lines.contains(&"bundle.mode=all".to_string()));
-        assert!(lines.contains(&"bundle.heuristic=creationToken".to_string()));
-        assert!(lines.contains(&"bundle.weekly-100.uri=https://example.com/test/repo/bundles/weekly/weekly-100.bundle".to_string()));
-        assert!(lines.contains(&"bundle.weekly-100.creationtoken=100".to_string()));
-    }
-
-    #[test]
-    fn filename_extraction() {
-        assert_eq!(filename_of("bundles/weekly/abc.bundle"), "abc.bundle");
-        assert_eq!(filename_of("abc.bundle"), "abc.bundle");
-    }
-}
diff --git a/crates/walgit-bundle/src/schedule.rs b/crates/walgit-bundle/src/schedule.rs
deleted file mode 100644
index fcccb85..0000000
--- a/crates/walgit-bundle/src/schedule.rs
+++ /dev/null
@@ -1,132 +0,0 @@
-//! Cron schedule parsing and due evaluation for bundle strategies.
-//!
-//! Supports the `cron` crate's 6/7-field syntax plus the `@hourly`, `@daily`,
-//! `@weekly` (and `@monthly`, `@yearly`) shorthand aliases natively parsed by
-//! the `cron` crate.
-
-use std::str::FromStr;
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-use chrono::{DateTime, Utc};
-use cron::Schedule;
-
-use crate::BundleError;
-
-/// Parse a cron expression or shorthand alias into a [`Schedule`].
-///
-/// The `cron` crate already handles `@hourly`/`@daily`/`@weekly`/`@monthly`/
-/// `@yearly`, so this is a thin wrapper that surfaces a useful error.
-pub fn parse_schedule(expr: &str) -> Result<Schedule, BundleError> {
-    Schedule::from_str(expr.trim())
-        .map_err(|e| BundleError::InvalidSchedule(format!("{expr}: {e}")))
-}
-
-/// Convert [`SystemTime`] to a chrono UTC datetime.
-fn to_chrono(t: SystemTime) -> DateTime<Utc> {
-    DateTime::<Utc>::from(t)
-}
-
-/// Convert a chrono UTC datetime back to [`SystemTime`].
-fn to_system(dt: DateTime<Utc>) -> SystemTime {
-    UNIX_EPOCH + Duration::from_secs(dt.timestamp().max(0).unsigned_abs())
-}
-
-/// Next fire time of `schedule` strictly after `after`, or `None` if the
-/// schedule is exhausted (e.g. a bounded year range has passed).
-pub fn next_fire_after(schedule: &Schedule, after: SystemTime) -> Option<SystemTime> {
-    let dt = to_chrono(after);
-    schedule.after(&dt).next().map(to_system)
-}
-
-/// Whether a strategy is due at `now`.
-///
-/// * `last_built` = `None` (never built) → due.
-/// * `last_built` = `Some(t)` → due iff the next scheduled fire after `t`
-///   is at or before `now`.
-/// * If the schedule is exhausted → not due.
-pub fn is_due(schedule: &Schedule, last_built: Option<SystemTime>, now: SystemTime) -> bool {
-    match last_built {
-        None => true,
-        Some(last) => {
-            let next = next_fire_after(schedule, last);
-            match next {
-                Some(fire) => fire <= now,
-                None => false,
-            }
-        }
-    }
-}
-
-/// Current Unix timestamp in seconds (for `creation_token` computation).
-pub fn unix_now(now: SystemTime) -> u64 {
-    now.duration_since(UNIX_EPOCH).map_or(0, |d| d.as_secs())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_aliases() {
-        assert!(parse_schedule("@hourly").is_ok());
-        assert!(parse_schedule("@daily").is_ok());
-        assert!(parse_schedule("@weekly").is_ok());
-        assert!(parse_schedule("@monthly").is_ok());
-        assert!(parse_schedule("@yearly").is_ok());
-    }
-
-    #[test]
-    fn parse_6field() {
-        assert!(parse_schedule("0 0 * * * *").is_ok()); // hourly
-        assert!(parse_schedule("0 0 0 * * *").is_ok()); // daily
-        assert!(parse_schedule("0 0 0 * * 1").is_ok()); // weekly (Sunday, 6 fields)
-    }
-
-    #[test]
-    fn parse_7field() {
-        assert!(parse_schedule("0 30 9 * * * 2024").is_ok());
-        assert!(parse_schedule("0 0 0 * * 1 *").is_ok()); // weekly (Sunday, 7 fields)
-    }
-
-    #[test]
-    fn parse_bad() {
-        assert!(parse_schedule("not a cron").is_err());
-        assert!(parse_schedule("").is_err());
-    }
-
-    #[test]
-    fn due_never_built() {
-        let s = parse_schedule("@hourly").unwrap();
-        let now = SystemTime::now();
-        assert!(is_due(&s, None, now));
-    }
-
-    #[test]
-    fn due_after_fire_time() {
-        let s = parse_schedule("@hourly").unwrap();
-        let now = SystemTime::now();
-        // Last built 2 hours ago → next fire was 1 hour ago → due.
-        let last = now - Duration::from_hours(2);
-        assert!(is_due(&s, Some(last), now));
-    }
-
-    #[test]
-    fn not_due_before_fire_time() {
-        let s = parse_schedule("@daily").unwrap();
-        let now = SystemTime::now();
-        // Last built 1 second ago → next fire is ~24h away → not due.
-        let last = now - Duration::from_secs(1);
-        assert!(!is_due(&s, Some(last), now));
-    }
-
-    #[test]
-    fn next_fire_advances() {
-        let s = parse_schedule("@hourly").unwrap();
-        let t = SystemTime::UNIX_EPOCH + Duration::from_secs(1_700_000_000);
-        let next = next_fire_after(&s, t).unwrap();
-        // Next fire should be after t.
-        assert!(next > t);
-        // And within 1 hour (hourly schedule).
-        assert!(next <= t + Duration::from_hours(1));
-    }
-}
diff --git a/crates/walgit-bundle/src/slots.rs b/crates/walgit-bundle/src/slots.rs
deleted file mode 100644
index 9dc18ab..0000000
--- a/crates/walgit-bundle/src/slots.rs
+++ /dev/null
@@ -1,1294 +0,0 @@
-#![allow(clippy::doc_lazy_continuation)]
-//! Calendar-slot scheduling with backfill.
-//!
-//! A strategy's cron expression defines **slots** (its fire times). Each
-//! slot gets exactly one bundle whose content is the ref state *as of the
-//! slot time* (the WAL seq whose entries were created at or before it) and
-//! whose `creation_token` is the slot's epoch seconds — deterministic, so
-//! backfilled slots sort correctly even when built out of order, and git's
-//! `creationToken` heuristic downloads exactly the bundles newer than what it
-//! has. A maintainer pass computes every slot from the chain's anchor to now
-//! and builds the **missing** ones oldest first (holes from downtime get
-//! filled); `backfill_max` bounds one pass.
-//!
-//! Chain: an incremental slot's prerequisite is the newest bundle of its base
-//! strategy with slot ≤ this slot (a daily after a new weekly restarts from
-//! it). Retention is a contiguous chain (see [`retain`]).
-
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-use walgit_config::{BundleKind, BundleStrategy, BundlesConfig};
-use walgit_proto::v1::{BundleEntry, BundleList};
-
-use crate::BundleError;
-use crate::schedule::parse_schedule;
-
-/// Why a slot is not (to be) built.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum SlotStatus {
-    /// A bundle exists for this slot.
-    Built { id: String, size: u64, seq: u64 },
-    /// No bundle yet: the next pass builds it (oldest first).
-    Missing,
-    /// The slot fired less than `SLOT_CLOSE_GRACE` ago: a writer's entry with `created_at ≤ slot`
-    /// may still land, so it is not work yet — the pass after the grace builds or settles it.
-    /// (Without this every pass ran a unit for the newest slot that found nothing to build, one
-    /// `nothing to build` row per minute on the rig, and starved fsck/compaction.)
-    Pending,
-    /// Not buildable (yet): e.g. an incremental slot with no base bundle ≤ slot.
-    Blocked(String),
-    /// Measured under the minimum-size gate (`bundles.min_commits`) by this
-    /// maintainer: not cut; the next slot of the strategy covers it.
-    TooSmall { commits: u64, min: u64 },
-    /// No WAL state exists at or before this slot (the repository was
-    /// imported later): nothing exists to cut yet, not an error.
-    Unavailable,
-    /// Measured on a closed slot and recorded in the list (`BundleList.skipped`):
-    /// final for this base — nobody re-measures it.
-    Skipped { reason: String },
-    /// Buildable, but not on this host: the unit needs a local copy bigger
-    /// than the maintainer's declared capacity (or a base repack on tmpfs).
-    /// Another maintainer (the big host) owns it.
-    WrongHost(String),
-}
-
-/// One row of a repository's slot table.
-#[derive(Debug, Clone)]
-pub struct SlotPlan {
-    pub strategy: String,
-    pub kind: BundleKind,
-    /// Slot time (= `creation_token`).
-    pub slot: u64,
-    pub status: SlotStatus,
-    /// For incrementals: the base bundle id this slot chains to (if any).
-    pub base_id: Option<String>,
-}
-
-pub fn epoch(t: SystemTime) -> u64 {
-    t.duration_since(UNIX_EPOCH).map_or(0, |d| d.as_secs())
-}
-pub fn from_epoch(s: u64) -> SystemTime {
-    UNIX_EPOCH + Duration::from_secs(s)
-}
-
-/// Slot times of `strategy` in `(after, upto]` (fire times of its cron).
-pub fn slots_between(
-    strategy: &BundleStrategy,
-    after: SystemTime,
-    upto: SystemTime,
-) -> Result<Vec<u64>, BundleError> {
-    let sched = parse_schedule(&strategy.schedule)?;
-    let mut out = Vec::new();
-    let mut cursor = after;
-    // Hard cap so a misconfigured schedule cannot loop forever.
-    for _ in 0..20_000 {
-        let Some(next) = crate::schedule::next_fire_after(&sched, cursor) else {
-            break;
-        };
-        if next > upto {
-            break;
-        }
-        out.push(epoch(next));
-        cursor = next;
-    }
-    Ok(out)
-}
-
-/// Whether `slot` is closed at `now`: its as-of instant lies at least
-/// [`SLOT_CLOSE_GRACE`] in the past. Entries are stamped `created_at` at publish
-/// time, monotonic, so nothing with `created_at ≤ slot` can arrive afterwards
-/// (explicit `created_at` replays excepted — they must clear `skipped`). The
-/// grace absorbs clock skew between writers. (An earlier rule, "the strategy's
-/// next fire has passed", left a daily re-measured every pass for 24 h.)
-pub fn slot_closed(_strategy: &BundleStrategy, slot: u64, now: SystemTime) -> bool {
-    from_epoch(slot) + SLOT_CLOSE_GRACE <= now
-}
-
-/// Clock-skew margin before a slot's verdict is treated as final.
-pub const SLOT_CLOSE_GRACE: Duration = Duration::from_mins(2);
-
-/// The newest slot of `strategy` at or before `t` (its most recent fire ≤ t).
-pub fn last_slot_at_or_before(
-    strategy: &BundleStrategy,
-    t: SystemTime,
-) -> Result<Option<u64>, BundleError> {
-    // Walk back through growing windows ending at `t`, smallest first: the first window with a
-    // fire holds the answer. (One 400-day window under the iteration cap of `slots_between`
-    // stopped days short of `t` for minute-scale schedules — the rig's "weekly" got a token
-    // 5.7 days old, 2026-08-22.)
-    for days in [1u64, 8, 40, 400] {
-        let start = t
-            .checked_sub(Duration::from_secs(days * 86_400))
-            .unwrap_or(UNIX_EPOCH);
-        if let Some(last) = slots_between(strategy, start, t)?.last() {
-            return Ok(Some(*last));
-        }
-    }
-    Ok(None)
-}
-
-fn entries_of<'a>(list: &'a BundleList, strategy: &str) -> Vec<&'a BundleEntry> {
-    let mut v: Vec<&BundleEntry> = list
-        .bundles
-        .iter()
-        .filter(|b| b.strategy == strategy)
-        .collect();
-    v.sort_by_key(|b| b.creation_token);
-    v
-}
-
-/// Newest bundle of `strategy` with token ≤ `slot`.
-pub fn base_for_slot<'a>(
-    list: &'a BundleList,
-    strategy: &str,
-    slot: u64,
-) -> Option<&'a BundleEntry> {
-    entries_of(list, strategy)
-        .into_iter()
-        .rfind(|b| b.creation_token <= slot)
-}
-
-/// The base bundle of an incremental at `slot`, **up the chain**: the newest
-/// bundle of `base` at or before the slot, else of the base's base, … up to
-/// the chain's full root. A repository's first day has hourlies before its
-/// first daily exists; they are cut on the weekly (prerequisites = the
-/// weekly's tips, always satisfiable by a client that has the weekly) instead
-/// of being blocked — or, worse, of a "daily" being cut at the hourly's slot.
-/// (2026-08-21: a large repository's hourlies only existed because a header-only legacy
-/// daily happened to be in the list.)
-pub fn base_for_slot_chain<'a>(
-    cfg: &BundlesConfig,
-    list: &'a BundleList,
-    base: &str,
-    slot: u64,
-) -> Option<&'a BundleEntry> {
-    let mut name = base;
-    loop {
-        if let Some(b) = base_for_slot(list, name, slot) {
-            return Some(b);
-        }
-        name = cfg
-            .strategy
-            .iter()
-            .find(|s| s.name == name)?
-            .base
-            .as_deref()?;
-    }
-}
-
-/// The base of an incremental of `strat` at `slot` — **the one rule** for both topologies:
-/// * `chain = false` (D21): the newest base bundle at or before the slot, up the chain
-///   (`base_for_slot_chain`).
-/// * `chain = true`: this strategy's own newest bundle before the slot, **if it is newer than
-///   that base** (dailies chain from the weekly onwards; hourlies restart from every new daily
-///   instead of chaining across it); else the base.
-/// `slot = 0` (a manual cut, "now"): the same with the newest bundles overall.
-pub fn base_for_incremental<'a>(
-    cfg: &BundlesConfig,
-    list: &'a BundleList,
-    strat: &BundleStrategy,
-    slot: u64,
-) -> Option<&'a BundleEntry> {
-    let base_name = strat.base.as_deref()?;
-    let at = if slot == 0 { u64::MAX } else { slot };
-    let base = if slot == 0 {
-        chain_up(cfg, base_name)
-            .into_iter()
-            .find_map(|n| entries_of(list, n).last().copied())
-    } else {
-        base_for_slot_chain(cfg, list, base_name, slot)
-    };
-    if !strat.chain {
-        return base;
-    }
-    let own = entries_of(list, &strat.name)
-        .into_iter()
-        .rfind(|b| b.creation_token < at);
-    // `>=`: at a tie (Sunday's daily and the weekly fire at the same instant, so their tips are the
-    // same objects) the chain continues through its own link. A fresh clone has the weekly's objects
-    // and therefore that link's prerequisites; a stale client walks daily → daily straight across
-    // the week boundary without ever needing the new full (git would otherwise download it: the
-    // creationToken walk passes every newer full, and a full has no prerequisites — rig, 2026-08-22).
-    match (own, base) {
-        (Some(o), Some(b)) if o.creation_token >= b.creation_token => Some(o),
-        (Some(o), None) => Some(o),
-        (_, base) => base,
-    }
-}
-
-/// The chain of strategy names from `base` up to the full root (inclusive).
-pub fn chain_up_names<'a>(cfg: &'a BundlesConfig, base: &'a str) -> Vec<&'a str> {
-    chain_up(cfg, base)
-}
-
-fn chain_up<'a>(cfg: &'a BundlesConfig, base: &'a str) -> Vec<&'a str> {
-    let mut out = vec![base];
-    let mut name = base;
-    while let Some(next) = cfg
-        .strategy
-        .iter()
-        .find(|s| s.name == name)
-        .and_then(|s| s.base.as_deref())
-    {
-        out.push(next);
-        name = next;
-    }
-    out
-}
-
-/// The slot table of a repository at `now`: for every strategy, the slots
-/// from the chain anchor to now and whether each is built / missing /
-/// blocked. The anchor of a full strategy is its newest built slot (nothing
-/// older is rebuilt) or, when none exists, the most recent slot ≤ now (a fresh
-/// repo gets exactly one full bundle, not a year of history). The anchor of an
-/// incremental strategy is the slot of the newest base bundle (a chain starts
-/// at its base).
-/// What the planner knows about the repository and this host.
-#[derive(Debug, Clone, Copy, Default)]
-pub struct PlanContext {
-    /// Earliest WAL state (`created_at` of the first entry / checkpoint); slots
-    /// before it are `Unavailable`. None = unknown → never unavailable.
-    pub first_state: Option<SystemTime>,
-    /// Whether this host can cut a **full** bundle for the repo (a compose of
-    /// an existing base always can; a repack needs the local copy + ssd).
-    pub can_full: bool,
-    /// Whether this host can cut **incremental** bundles (needs a serving copy
-    /// that fits: history/small packs local, base linked/remote is fine).
-    pub can_incremental: bool,
-    /// Human reason when a kind cannot run here (→ `WrongHost`).
-    pub wrong_host_reason: Option<&'static str>,
-}
-
-pub fn plan(
-    cfg: &BundlesConfig,
-    list: &BundleList,
-    now: SystemTime,
-    can_build_full: bool,
-) -> Result<Vec<SlotPlan>, BundleError> {
-    plan_with(
-        cfg,
-        list,
-        now,
-        PlanContext {
-            first_state: None,
-            can_full: can_build_full,
-            can_incremental: true,
-            wrong_host_reason: None,
-        },
-    )
-}
-
-pub fn plan_with(
-    cfg: &BundlesConfig,
-    list: &BundleList,
-    now: SystemTime,
-    ctx: PlanContext,
-) -> Result<Vec<SlotPlan>, BundleError> {
-    let can_build_full = ctx.can_full;
-    let mut rows = Vec::new();
-    for strat in &cfg.strategy {
-        let built = entries_of(list, &strat.name);
-        let (anchor_excl, ()): (SystemTime, ()) = match strat.kind {
-            BundleKind::Full => match built.last() {
-                // Newest built full: everything after it is a candidate.
-                Some(b) => (from_epoch(b.creation_token), ()),
-                None => {
-                    // No full yet: only the latest slot ≤ now.
-                    match last_slot_at_or_before(strat, now)? {
-                        Some(s) => (from_epoch(s - 1), ()),
-                        None => continue,
-                    }
-                }
-            },
-            BundleKind::Incremental => {
-                let base_name = strat.base.as_deref().unwrap_or("");
-                // The newest bundle of the nearest strategy up the chain that has one
-                // (daily, else weekly): the anchor of this chain.
-                let anchored = chain_up(cfg, base_name)
-                    .into_iter()
-                    .find_map(|n| entries_of(list, n).last().map(|b| (n, *b)));
-                match anchored {
-                    // Chained: every slot after the newest base is a delta of its own; nothing
-                    // before the base is ever wanted.
-                    Some((_, b)) if strat.chain => (from_epoch(b.creation_token), ()),
-                    Some((anchor_name, b)) => {
-                        // Start at the newest base; but keep older built
-                        // incrementals visible via their own anchor: a chain
-                        // on the previous base still serves clients there.
-                        let oldest_relevant = entries_of(list, anchor_name)
-                            .iter()
-                            .rev()
-                            .nth(1)
-                            .map_or(b.creation_token, |prev| prev.creation_token);
-                        (from_epoch(oldest_relevant), ())
-                    }
-                    _ => {
-                        rows.push(SlotPlan {
-                            strategy: strat.name.clone(),
-                            kind: strat.kind,
-                            slot: 0,
-                            status: SlotStatus::Blocked(format!("no {base_name} bundle yet")),
-                            base_id: None,
-                        });
-                        continue;
-                    }
-                }
-            }
-        };
-        let slots = slots_between(strat, anchor_excl, now)?;
-        // Incrementals: only the newest `INCREMENTALS_KEPT` slots are desired (retention
-        // keeps no more; an older slot's content is subsumed by the newer one on the same
-        // base). Built older entries stay visible until retention drops them; missing older
-        // slots are not work.
-        let wanted_from = match strat.kind {
-            BundleKind::Incremental if !strat.chain => {
-                slots.len().saturating_sub(INCREMENTALS_KEPT)
-            }
-            // Chained: every slot since the base — bounded to one period of the base strategy
-            // (24 hourlies under a daily, 7 dailies under a weekly): a chain under a base that is
-            // months old (a stale list, an outage) is not months of work, and anything older than
-            // the period would be pruned by retention as soon as the next base is cut.
-            BundleKind::Incremental => slots.len().saturating_sub(chain_window(cfg, strat).max(1)),
-            BundleKind::Full => 0,
-        };
-        for (i, slot) in slots.into_iter().enumerate() {
-            let existing = built
-                .iter()
-                .find(|b| b.creation_token == slot || b.slot == slot);
-            if existing.is_none() && i < wanted_from {
-                continue;
-            }
-            let base_id = match strat.kind {
-                BundleKind::Full => None,
-                BundleKind::Incremental => {
-                    base_for_incremental(cfg, list, strat, slot).map(|b| b.id.clone())
-                }
-            };
-            // The first full of a chain is never unavailable: a repository that
-            // appeared after the slot gets its first full bundle cut from its
-            // earliest state (for a large repository, the import) — that is what "weekly =
-            // import state" means; later slots are as-of by construction.
-            let first_full = strat.kind == BundleKind::Full && built.is_empty();
-            let unavailable = !first_full && ctx.first_state.is_some_and(|t| from_epoch(slot) < t);
-            let skipped = list.skipped.iter().find(|k| {
-                k.strategy == strat.name
-                    && k.slot == slot
-                    && k.base_id == base_id.clone().unwrap_or_default()
-            });
-            let status = match existing {
-                Some(b) => SlotStatus::Built {
-                    id: b.id.clone(),
-                    size: b.size,
-                    seq: b.seq,
-                },
-                None if unavailable => SlotStatus::Unavailable,
-                None if skipped.is_some() => SlotStatus::Skipped {
-                    reason: skipped.map(|k| k.reason.clone()).unwrap_or_default(),
-                },
-                None if strat.kind == BundleKind::Incremental && !slot_closed(strat, slot, now) => {
-                    SlotStatus::Pending
-                }
-                None => match strat.kind {
-                    BundleKind::Full if !can_build_full => SlotStatus::WrongHost(
-                        ctx.wrong_host_reason
-                            .unwrap_or("full bundles need the base pack locally (ssd host)")
-                            .into(),
-                    ),
-                    BundleKind::Incremental if base_id.is_none() => {
-                        SlotStatus::Blocked("no base bundle at or before this slot".into())
-                    }
-                    BundleKind::Incremental if !ctx.can_incremental => SlotStatus::WrongHost(
-                        ctx.wrong_host_reason
-                            .unwrap_or("the serving copy does not fit this host")
-                            .into(),
-                    ),
-                    BundleKind::Full | BundleKind::Incremental => SlotStatus::Missing,
-                },
-            };
-            rows.push(SlotPlan {
-                strategy: strat.name.clone(),
-                kind: strat.kind,
-                slot,
-                status,
-                base_id,
-            });
-        }
-    }
-    rows.sort_by_key(|r| (r.slot, r.kind == BundleKind::Incremental));
-    Ok(rows)
-}
-
-/// How many slots of a chained strategy fit in one period of its base strategy (24 hourlies per
-/// daily, 7 dailies per weekly): the most a chain under one base can ever need.
-pub fn chain_window(cfg: &BundlesConfig, strat: &BundleStrategy) -> usize {
-    let Some(base) = strat
-        .base
-        .as_deref()
-        .and_then(|n| cfg.strategy.iter().find(|s| s.name == n))
-    else {
-        return usize::MAX;
-    };
-    let (Ok(bs), Ok(_)) = (
-        parse_schedule(&base.schedule),
-        parse_schedule(&strat.schedule),
-    ) else {
-        return usize::MAX;
-    };
-    // Two consecutive base fires from an arbitrary anchor; the count of our fires between them.
-    let anchor = from_epoch(1_700_000_000);
-    let Some(b1) = crate::schedule::next_fire_after(&bs, anchor) else {
-        return usize::MAX;
-    };
-    let Some(b2) = crate::schedule::next_fire_after(&bs, b1) else {
-        return usize::MAX;
-    };
-    slots_between(strat, b1, b2).map_or(usize::MAX, |v| v.len())
-}
-
-/// How many bundles of an incremental strategy stay listed: the newest, and the one
-/// before it. Incrementals are built on their *base* (a daily on the weekly, an hourly
-/// on the newest daily), never on their own predecessor, so the newest one subsumes every
-/// older one on the same base — and git's `creationToken` heuristic downloads **every**
-/// listed bundle newer than the newest full on a clone (descending until a bundle whose
-/// prerequisites it has), so anything older than the newest is pure cost: 43 downloads /
-/// 11.5 s for a 1 MB repository on 2026-08-22. The second one stays so a client that read
-/// the list a slot ago still finds its bundle (git never retries a failed download, D17).
-pub const INCREMENTALS_KEPT: usize = 2;
-
-/// Retention (D21 amended 2026-08-22): keep the newest `keep` fulls, and per incremental
-/// strategy the `INCREMENTALS_KEPT` newest bundles whose base is kept — never an orphan.
-/// Returns the object keys to delete. Fresh clone = 1 full + ≤ 2 dailies + ≤ 2 hourlies;
-/// catch-up ≤ 2 bundles.
-pub fn retain(cfg: &BundlesConfig, list: &mut BundleList) -> Vec<String> {
-    use std::collections::HashSet;
-    let mut keep: HashSet<String> = HashSet::new();
-    // Fulls: newest `keep`.
-    for strat in cfg.strategy.iter().filter(|s| s.kind == BundleKind::Full) {
-        let mut v = entries_of(list, &strat.name);
-        v.reverse();
-        for b in v.into_iter().take(strat.keep.max(1)) {
-            keep.insert(b.id.clone());
-        }
-    }
-    // Incrementals, in dependency order (strategies listed base-first), **per kept full**: the
-    // week under each kept weekly is a group — tokens in (this full, next full] — and the rule
-    // applies inside every group, so `keep = 2` on the weekly is two weeks of catch-up through
-    // bundles (a client stale by less than that always meets a link whose prerequisites it has).
-    // In a group: D21 (unchained) = the newest `INCREMENTALS_KEPT` whose base survived; chained =
-    // every link newer than the newest kept bundle of the base strategy in the group whose own base
-    // survived (≤ 7 dailies under a weekly, ≤ 24 hourlies under a daily).
-    let mut full_tokens: Vec<u64> = list
-        .bundles
-        .iter()
-        .filter(|b| keep.contains(&b.id) && b.base_id.is_empty())
-        .map(|b| b.creation_token)
-        .collect();
-    full_tokens.sort_unstable();
-    full_tokens.dedup();
-    // Group i = the kept full F_i and the incrementals with tokens in (F_i, F_{i+1}]: a bundle cut at
-    // a full's own instant belongs to the previous week (Sunday's daily under the old weekly — its
-    // tips equal the new weekly's). Incrementals before the first kept full fall into group 0 and
-    // are pruned there (their base is gone).
-    let group_of = |b: &BundleEntry| -> usize {
-        let below = full_tokens
-            .iter()
-            .take_while(|t| **t < b.creation_token)
-            .count();
-        if b.base_id.is_empty() {
-            below
-        } else {
-            below.saturating_sub(1)
-        }
-    };
-    for strat in cfg
-        .strategy
-        .iter()
-        .filter(|s| s.kind == BundleKind::Incremental)
-    {
-        let v = entries_of(list, &strat.name);
-        let groups = full_tokens.len() + 1;
-        for g in 0..groups {
-            let in_group: Vec<&BundleEntry> =
-                v.iter().copied().filter(|b| group_of(b) == g).collect();
-            if strat.chain {
-                let base_newest = strat.base.as_deref().map_or(0, |n| {
-                    entries_of(list, n)
-                        .into_iter()
-                        .filter(|b| keep.contains(&b.id) && group_of(b) == g)
-                        .map(|b| b.creation_token)
-                        .max()
-                        .unwrap_or(0)
-                });
-                // Oldest first so a link's base (the previous link) is decided before it. The first
-                // link of a group may point at a pruned link of the previous group (Monday on Sunday's
-                // daily): its prerequisites are the group's full's tips, so it stays while the full does.
-                let group_full_kept = full_tokens.get(g).is_some();
-                let mut first = true;
-                for b in in_group {
-                    if b.creation_token <= base_newest {
-                        continue;
-                    }
-                    let anchored = b.base_id.is_empty()
-                        || keep.contains(&b.base_id)
-                        || (first && group_full_kept);
-                    first = false;
-                    if anchored {
-                        keep.insert(b.id.clone());
-                    }
-                }
-            } else {
-                let chosen: Vec<String> = in_group
-                    .into_iter()
-                    .rev()
-                    .filter(|b| b.base_id.is_empty() || keep.contains(&b.base_id))
-                    .take(INCREMENTALS_KEPT)
-                    .map(|b| b.id.clone())
-                    .collect();
-                keep.extend(chosen);
-            }
-        }
-    }
-    let mut pruned = Vec::new();
-    let mut kept = Vec::new();
-    for b in list.bundles.drain(..) {
-        if keep.contains(&b.id) {
-            kept.push(b);
-        } else {
-            pruned.push(b.key.clone());
-        }
-    }
-    list.bundles = kept;
-    pruned
-}
-
-/// Default ref set for a bundle (see `bundles.main_only` / `extra_refs`).
-pub fn default_refs(cfg: &BundlesConfig, strategy: &BundleStrategy) -> Vec<String> {
-    if !strategy.refs.is_empty() {
-        return strategy.refs.clone();
-    }
-    let mut v: Vec<String> = if cfg.main_only {
-        vec!["HEAD".into(), "refs/heads/main".into()]
-    } else {
-        vec!["refs/heads/*".into(), "refs/tags/*".into(), "HEAD".into()]
-    };
-    v.extend(cfg.extra_refs.iter().cloned());
-    v
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The D21 shape (every incremental on its base): what the two-newest tests below pin.
-    fn cfg() -> BundlesConfig {
-        let mut c = BundlesConfig::default();
-        for s in &mut c.strategy {
-            s.chain = false;
-        }
-        c
-    }
-
-    /// The default shape: weekly full, chained dailies, hourlies on the newest daily.
-    #[test]
-    fn default_shape_chains_the_dailies_only() {
-        let c = BundlesConfig::default();
-        let by: std::collections::HashMap<&str, &BundleStrategy> =
-            c.strategy.iter().map(|s| (s.name.as_str(), s)).collect();
-        assert!(!by["weekly"].chain && by["daily"].chain && !by["hourly"].chain);
-        assert_eq!(chain_window(&c, by["daily"]), 7);
-    }
-    fn t(s: &str) -> SystemTime {
-        let dt = chrono::DateTime::parse_from_rfc3339(s).unwrap();
-        from_epoch(dt.timestamp().max(0).unsigned_abs())
-    }
-    fn entry(strategy: &str, slot: u64, base_id: &str) -> BundleEntry {
-        BundleEntry {
-            id: format!("{strategy}-{slot}"),
-            key: format!("bundles/{strategy}/{slot}.bundle"),
-            strategy: strategy.into(),
-            kind: if strategy == "weekly" {
-                "full"
-            } else {
-                "incremental"
-            }
-            .into(),
-            filter: String::new(),
-            creation_token: slot,
-            slot,
-            seq: 1,
-            size: 1,
-            base_id: base_id.into(),
-            created_at: None,
-            version: String::new(),
-            tips: vec![],
-        }
-    }
-
-    #[test]
-    fn default_schedules_fire_on_the_calendar() {
-        let c = cfg();
-        let weekly = &c.strategy[0];
-        // Sunday 2026-08-23 23:00Z is a slot; the week before too.
-        let s =
-            slots_between(weekly, t("2026-08-16T22:59:00Z"), t("2026-08-23T23:00:00Z")).unwrap();
-        assert_eq!(
-            s,
-            vec![
-                epoch(t("2026-08-16T23:00:00Z")),
-                epoch(t("2026-08-23T23:00:00Z"))
-            ]
-        );
-        let daily = &c.strategy[1];
-        assert_eq!(
-            slots_between(daily, t("2026-08-20T00:00:00Z"), t("2026-08-21T23:30:00Z"))
-                .unwrap()
-                .len(),
-            2
-        );
-        let hourly = &c.strategy[2];
-        assert_eq!(
-            slots_between(hourly, t("2026-08-20T10:30:00Z"), t("2026-08-20T13:00:00Z"))
-                .unwrap()
-                .len(),
-            3
-        );
-    }
-
-    /// Minute-scale schedules (a test rig) must resolve their newest slot exactly, not a capped
-    /// walk from a year ago.
-    #[test]
-    fn last_slot_is_exact_for_minute_scale_schedules() {
-        let mut strat = cfg().strategy[0].clone();
-        strat.schedule = "0 */10 * * * *".into();
-        let now = t("2026-08-22T16:22:45Z");
-        assert_eq!(
-            last_slot_at_or_before(&strat, now).unwrap(),
-            Some(epoch(t("2026-08-22T16:20:00Z")))
-        );
-        strat.schedule = "0 * * * * *".into();
-        assert_eq!(
-            last_slot_at_or_before(&strat, now).unwrap(),
-            Some(epoch(t("2026-08-22T16:22:00Z")))
-        );
-        // And the calendar ones still do.
-        let weekly = &cfg().strategy[0];
-        assert_eq!(
-            last_slot_at_or_before(weekly, now).unwrap(),
-            Some(epoch(t("2026-08-16T23:00:00Z")))
-        );
-    }
-
-    #[test]
-    fn fresh_repo_plans_one_full_and_nothing_older() {
-        let c = cfg();
-        let list = BundleList::default();
-        let now = t("2026-08-20T12:30:00Z"); // Thursday
-        let rows = plan(&c, &list, now, true).unwrap();
-        let fulls: Vec<&SlotPlan> = rows.iter().filter(|r| r.strategy == "weekly").collect();
-        assert_eq!(fulls.len(), 1);
-        assert_eq!(
-            fulls[0].slot,
-            epoch(t("2026-08-16T23:00:00Z")),
-            "latest Sunday 23:00 ≤ now"
-        );
-        assert_eq!(fulls[0].status, SlotStatus::Missing);
-        // Incrementals are blocked until the weekly exists.
-        assert!(
-            rows.iter()
-                .filter(|r| r.strategy == "daily")
-                .all(|r| matches!(r.status, SlotStatus::Blocked(_)))
-        );
-    }
-
-    /// D21 (2026-08-22): incrementals are independent of their predecessors, so after a gap only
-    /// the `INCREMENTALS_KEPT` newest slots of each strategy are work — never a backfill of
-    /// slots whose content the newer one subsumes (and retention would drop at once).
-    #[test]
-    fn backfill_after_a_three_day_gap_is_only_the_two_newest_slots_per_strategy() {
-        let c = cfg();
-        let mut list = BundleList::default();
-        let weekly_slot = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", weekly_slot, ""));
-        // Dailies built through Monday 17th 23:00, hourlies through Tue 18th 00:00.
-        let d1 = epoch(t("2026-08-17T23:00:00Z"));
-        list.bundles
-            .push(entry("daily", d1, "weekly-".to_string().as_str()));
-        list.bundles.last_mut().unwrap().base_id = format!("weekly-{weekly_slot}");
-        let h0 = epoch(t("2026-08-18T00:00:00Z"));
-        list.bundles
-            .push(entry("hourly", h0, &format!("daily-{d1}")));
-        // Maintainer was down; now it is Friday 21st 12:30.
-        let now = t("2026-08-21T12:30:00Z");
-        let rows = plan(&c, &list, now, false).unwrap();
-        let missing_daily: Vec<u64> = rows
-            .iter()
-            .filter(|r| r.strategy == "daily" && r.status == SlotStatus::Missing)
-            .map(|r| r.slot)
-            .collect();
-        assert_eq!(
-            missing_daily,
-            vec![
-                epoch(t("2026-08-19T23:00:00Z")),
-                epoch(t("2026-08-20T23:00:00Z"))
-            ],
-            "the 2 newest daily slots, oldest first; Tue 18th is not work"
-        );
-        // Hourlies missing: only Fri 11:00 and 12:00 (the 2 newest slots ≤ now).
-        let missing_hourly: Vec<u64> = rows
-            .iter()
-            .filter(|r| r.strategy == "hourly" && r.status == SlotStatus::Missing)
-            .map(|r| r.slot)
-            .collect();
-        assert_eq!(
-            missing_hourly,
-            vec![
-                epoch(t("2026-08-21T11:00:00Z")),
-                epoch(t("2026-08-21T12:00:00Z"))
-            ]
-        );
-        // The built hourly stays visible; no row for the Tue..Thu slots nobody wants.
-        assert!(rows.iter().any(|r| r.strategy == "hourly"
-            && r.slot == h0
-            && matches!(r.status, SlotStatus::Built { .. })));
-        assert!(
-            !rows
-                .iter()
-                .any(|r| r.strategy == "hourly" && r.slot == epoch(t("2026-08-20T12:00:00Z")))
-        );
-        // Each missing hourly chains to the newest *built* daily ≤ its slot (the builder cuts dailies first).
-        let fri_noon = rows
-            .iter()
-            .find(|r| r.strategy == "hourly" && r.slot == epoch(t("2026-08-21T12:00:00Z")))
-            .unwrap();
-        assert_eq!(
-            fri_noon.base_id.as_deref(),
-            Some(format!("daily-{d1}").as_str())
-        );
-        // Weekly: no new full until the next Sunday 23:00 → no missing weekly (the VM builds fulls anyway).
-        assert!(
-            rows.iter()
-                .filter(|r| r.strategy == "weekly")
-                .all(|r| matches!(r.status, SlotStatus::Built { .. }))
-        );
-        // Tokens are the slots: monotonic in time regardless of build order.
-        let mut toks: Vec<u64> = rows.iter().map(|r| r.slot).collect();
-        toks.dedup();
-        assert!(toks.windows(2).all(|w| w[0] <= w[1]));
-    }
-
-    fn chained() -> BundlesConfig {
-        let mut c = cfg();
-        c.strategy[0].keep = 1;
-        c.strategy[1].chain = true;
-        c.strategy[2].chain = true;
-        c
-    }
-
-    /// `chain = true`: a daily's base is the previous daily once one exists after the weekly; an
-    /// hourly's base is the previous hourly until a newer daily appears, then that daily.
-    #[test]
-    fn chained_incrementals_base_on_their_predecessor_until_a_newer_base_appears() {
-        let c = chained();
-        let (daily, hourly) = (&c.strategy[1], &c.strategy[2]);
-        let mut list = BundleList::default();
-        let w = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", w, ""));
-        let d1 = epoch(t("2026-08-17T23:00:00Z"));
-        // First daily after the weekly: on the weekly.
-        assert_eq!(
-            base_for_incremental(&c, &list, daily, d1).unwrap().id,
-            format!("weekly-{w}")
-        );
-        list.bundles
-            .push(entry("daily", d1, &format!("weekly-{w}")));
-        // Second daily: on the first.
-        let d2 = epoch(t("2026-08-18T23:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&c, &list, daily, d2).unwrap().id,
-            format!("daily-{d1}")
-        );
-        // Hourlies after d1: the first on d1, the next on its predecessor.
-        let h1 = epoch(t("2026-08-18T00:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&c, &list, hourly, h1).unwrap().id,
-            format!("daily-{d1}")
-        );
-        list.bundles
-            .push(entry("hourly", h1, &format!("daily-{d1}")));
-        let h2 = epoch(t("2026-08-18T01:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&c, &list, hourly, h2).unwrap().id,
-            format!("hourly-{h1}")
-        );
-        list.bundles
-            .push(entry("hourly", h2, &format!("hourly-{h1}")));
-        // d2 is cut; the first hourly after it restarts from d2, not from h2.
-        list.bundles
-            .push(entry("daily", d2, &format!("daily-{d1}")));
-        let h3 = epoch(t("2026-08-19T00:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&c, &list, hourly, h3).unwrap().id,
-            format!("daily-{d2}")
-        );
-        // The D21 shape is untouched: without `chain` the same slot is cut on the newest daily.
-        let plain = cfg();
-        assert_eq!(
-            base_for_incremental(&plain, &list, &plain.strategy[2], h2)
-                .unwrap()
-                .id,
-            format!("daily-{d1}")
-        );
-        // A manual cut (slot 0) chains on the newest link.
-        assert_eq!(
-            base_for_incremental(&c, &list, hourly, 0).unwrap().id,
-            format!("daily-{d2}")
-        );
-        assert_eq!(
-            base_for_incremental(&c, &list, daily, 0).unwrap().id,
-            format!("daily-{d2}")
-        );
-    }
-
-    /// Chained: every slot since the newest base is wanted (each is its own delta), not just the
-    /// 2 newest; and nothing before the newest base.
-    #[test]
-    fn chained_plan_wants_every_slot_since_the_base() {
-        let c = chained();
-        let mut list = BundleList::default();
-        let w = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", w, ""));
-        let d1 = epoch(t("2026-08-17T23:00:00Z"));
-        list.bundles
-            .push(entry("daily", d1, &format!("weekly-{w}")));
-        let now = t("2026-08-21T12:30:00Z");
-        let rows = plan(&c, &list, now, false).unwrap();
-        let missing_daily: Vec<u64> = rows
-            .iter()
-            .filter(|r| r.strategy == "daily" && r.status == SlotStatus::Missing)
-            .map(|r| r.slot)
-            .collect();
-        assert_eq!(
-            missing_daily,
-            vec![
-                epoch(t("2026-08-18T23:00:00Z")),
-                epoch(t("2026-08-19T23:00:00Z")),
-                epoch(t("2026-08-20T23:00:00Z"))
-            ],
-            "every daily after the built one, oldest first"
-        );
-        // Planned bases: the first missing daily on d1 (the newest link), the later ones too until
-        // that link is built — the builder cuts oldest first, so each then lands on its predecessor.
-        let d2 = rows
-            .iter()
-            .find(|r| r.strategy == "daily" && r.slot == epoch(t("2026-08-18T23:00:00Z")))
-            .unwrap();
-        assert_eq!(d2.base_id.as_deref(), Some(format!("daily-{d1}").as_str()));
-        // Hourlies: every slot since d1 (the newest daily) is wanted, bounded to one daily period
-        // (24) — the older ones would be pruned the moment the next daily is cut.
-        assert_eq!(chain_window(&c, &c.strategy[2]), 24);
-        assert_eq!(chain_window(&c, &c.strategy[1]), 7);
-        let missing_hourly = rows
-            .iter()
-            .filter(|r| r.strategy == "hourly" && r.status == SlotStatus::Missing)
-            .count();
-        assert_eq!(missing_hourly, 24);
-    }
-
-    /// Chained retention: 1 weekly, the dailies after it, the hourlies after the newest daily.
-    #[test]
-    fn chained_retention_keeps_the_chain_below_the_newest_bases_only() {
-        let c = chained();
-        let mut list = BundleList::default();
-        let w0 = epoch(t("2026-08-09T23:00:00Z"));
-        let w1 = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", w0, ""));
-        list.bundles.push(entry("weekly", w1, ""));
-        // A daily on the old weekly, then three on the new chain.
-        let d_old = epoch(t("2026-08-15T23:00:00Z"));
-        list.bundles
-            .push(entry("daily", d_old, &format!("weekly-{w0}")));
-        let ds: Vec<u64> = [
-            "2026-08-17T23:00:00Z",
-            "2026-08-18T23:00:00Z",
-            "2026-08-19T23:00:00Z",
-        ]
-        .iter()
-        .map(|x| epoch(t(x)))
-        .collect();
-        list.bundles
-            .push(entry("daily", ds[0], &format!("weekly-{w1}")));
-        list.bundles
-            .push(entry("daily", ds[1], &format!("daily-{}", ds[0])));
-        list.bundles
-            .push(entry("daily", ds[2], &format!("daily-{}", ds[1])));
-        // Hourlies: two under the second daily (obsolete), two after the newest daily.
-        let h_old1 = epoch(t("2026-08-19T00:00:00Z"));
-        let h_old2 = epoch(t("2026-08-19T01:00:00Z"));
-        list.bundles
-            .push(entry("hourly", h_old1, &format!("daily-{}", ds[1])));
-        list.bundles
-            .push(entry("hourly", h_old2, &format!("hourly-{h_old1}")));
-        let h1 = epoch(t("2026-08-20T00:00:00Z"));
-        let h2 = epoch(t("2026-08-20T01:00:00Z"));
-        list.bundles
-            .push(entry("hourly", h1, &format!("daily-{}", ds[2])));
-        list.bundles
-            .push(entry("hourly", h2, &format!("hourly-{h1}")));
-        let pruned = retain(&c, &mut list);
-        let mut kept: Vec<&str> = list.bundles.iter().map(|b| b.id.as_str()).collect();
-        kept.sort_unstable();
-        let mut want = [
-            format!("weekly-{w1}"),
-            format!("daily-{}", ds[0]),
-            format!("daily-{}", ds[1]),
-            format!("daily-{}", ds[2]),
-            format!("hourly-{h1}"),
-            format!("hourly-{h2}"),
-        ];
-        want.sort();
-        assert_eq!(kept, want.iter().map(String::as_str).collect::<Vec<_>>());
-        assert_eq!(
-            pruned.len(),
-            4,
-            "old weekly, its daily, the two hourlies under an older daily"
-        );
-    }
-
-    /// The chain crosses the week: Sunday's daily and the weekly share an instant (and tips); Monday's
-    /// daily is cut on Sunday's daily, and with `keep = 2` the previous week's chain stays listed,
-    /// so a client stale by up to two weeks catches up daily → daily without the new full.
-    #[test]
-    fn chained_dailies_continue_through_the_weekly_and_keep_two_weeks() {
-        let mut c = chained();
-        c.strategy[0].keep = 2;
-        let (daily, hourly) = (c.strategy[1].clone(), c.strategy[2].clone());
-        let mut list = BundleList::default();
-        let w1 = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", w1, ""));
-        let mut prev = format!("weekly-{w1}");
-        // Mon 17 .. Sun 23 dailies (the Sunday one at the weekly's instant).
-        let mut sunday = 0;
-        for d in 17..=23 {
-            let slot = epoch(t(&format!("2026-08-{d}T23:00:00Z")));
-            assert_eq!(
-                base_for_incremental(&c, &list, &daily, slot).unwrap().id,
-                prev,
-                "day {d}"
-            );
-            list.bundles.push(entry("daily", slot, &prev));
-            prev = format!("daily-{slot}");
-            sunday = slot;
-        }
-        let w2 = epoch(t("2026-08-23T23:00:00Z"));
-        assert_eq!(sunday, w2);
-        list.bundles.push(entry("weekly", w2, ""));
-        // Monday 24th: on Sunday's daily (tie → own chain), not on the new weekly.
-        let mon = epoch(t("2026-08-24T23:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&c, &list, &daily, mon).unwrap().id,
-            format!("daily-{sunday}")
-        );
-        list.bundles
-            .push(entry("daily", mon, &format!("daily-{sunday}")));
-        // An hourly after Monday's daily hangs under it (hourlies are not chained here: D21 shape).
-        let mut plain = c.clone();
-        plain.strategy[2].chain = false;
-        let h = epoch(t("2026-08-25T01:00:00Z"));
-        assert_eq!(
-            base_for_incremental(&plain, &list, &hourly, h).unwrap().id,
-            format!("daily-{mon}")
-        );
-        list.bundles
-            .push(entry("hourly", h, &format!("daily-{mon}")));
-        // Retention with keep = 2: both weeklies, all 7 dailies of week 1, Monday, the hourly.
-        let mut probe = list.clone();
-        let pruned = retain(&c, &mut probe);
-        assert!(pruned.is_empty(), "nothing to prune: {pruned:?}");
-        assert_eq!(probe.bundles.len(), 2 + 7 + 1 + 1);
-        // keep = 1: week 1's chain goes (including Sunday's daily, which belongs to week 1), Monday stays.
-        c.strategy[0].keep = 1;
-        let mut probe = list.clone();
-        let pruned = retain(&c, &mut probe);
-        assert_eq!(pruned.len(), 1 + 7, "{pruned:?}");
-        assert!(probe.bundles.iter().any(|b| b.id == format!("daily-{mon}")));
-        assert!(probe.bundles.iter().any(|b| b.id == format!("weekly-{w2}")));
-    }
-
-    #[test]
-    fn slots_before_the_first_wal_state_are_unavailable_not_missing() {
-        let c = cfg();
-        let mut list = BundleList::default();
-        let weekly_slot = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", weekly_slot, ""));
-        // Repo imported Wed 19th 21:30 for a large repository), now Fri 00:30: the two wanted daily slots are Wed/Thu, both
-        // missing; Mon/Tue are neither wanted nor shown.
-        let ctx = PlanContext {
-            first_state: Some(t("2026-08-19T21:30:00Z")),
-            can_full: true,
-            can_incremental: true,
-            wrong_host_reason: None,
-        };
-        let rows = plan_with(&c, &list, t("2026-08-21T00:30:00Z"), ctx).unwrap();
-        let daily: Vec<(u64, &SlotStatus)> = rows
-            .iter()
-            .filter(|r| r.strategy == "daily")
-            .map(|r| (r.slot, &r.status))
-            .collect();
-        assert_eq!(daily.len(), 2, "{daily:?}");
-        assert_eq!(
-            daily[0],
-            (epoch(t("2026-08-19T23:00:00Z")), &SlotStatus::Missing),
-            "Wed 19th 23:00"
-        );
-        assert_eq!(
-            daily[1],
-            (epoch(t("2026-08-20T23:00:00Z")), &SlotStatus::Missing),
-            "Thu 20th 23:00"
-        );
-        // Imported Thu 22:00 instead: Wed is within the wanted window but predates the first state → unavailable.
-        let ctx2 = PlanContext {
-            first_state: Some(t("2026-08-20T22:00:00Z")),
-            ..ctx
-        };
-        let rows = plan_with(&c, &list, t("2026-08-21T00:30:00Z"), ctx2).unwrap();
-        let daily: Vec<(u64, &SlotStatus)> = rows
-            .iter()
-            .filter(|r| r.strategy == "daily")
-            .map(|r| (r.slot, &r.status))
-            .collect();
-        assert_eq!(daily[0].1, &SlotStatus::Unavailable, "Wed 19th");
-        assert_eq!(daily[1].1, &SlotStatus::Missing, "Thu 20th");
-        // A small host: incrementals are wrong-host, visible as such.
-        let small = PlanContext {
-            can_incremental: false,
-            wrong_host_reason: Some("cache too small"),
-            ..ctx
-        };
-        let rows = plan_with(&c, &list, t("2026-08-21T00:30:00Z"), small).unwrap();
-        assert!(
-            rows.iter()
-                .filter(|r| r.strategy == "daily")
-                .any(|r| matches!(r.status, SlotStatus::WrongHost(_)))
-        );
-    }
-
-    #[test]
-    fn retention_keeps_two_fulls_and_the_two_newest_incrementals_per_strategy() {
-        let mut c = cfg();
-        c.strategy[0].keep = 2;
-        let mut list = BundleList::default();
-        let w = |d: &str| epoch(t(&format!("2026-{d}T23:00:00Z")));
-        for day in ["07-26", "08-02", "08-09", "08-16"] {
-            list.bundles.push(entry("weekly", w(day), ""));
-            // one daily per weekly
-            let ds = w(day) + 86_400;
-            list.bundles
-                .push(entry("daily", ds, &format!("weekly-{}", w(day))));
-            let hs = ds + 3600;
-            list.bundles
-                .push(entry("hourly", hs, &format!("daily-{ds}")));
-        }
-        let pruned = retain(&c, &mut list);
-        let kept: Vec<&str> = list.bundles.iter().map(|b| b.id.as_str()).collect();
-        // Two newest weeklies + the two newest dailies/hourlies (which sit on them); the older chains pruned.
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "weekly")
-                .count(),
-            2
-        );
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "daily")
-                .count(),
-            2
-        );
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "hourly")
-                .count(),
-            2
-        );
-        assert_eq!(pruned.len(), 6);
-        assert!(
-            kept.iter()
-                .all(|k| !k.contains(&w("07-26").to_string())
-                    && !k.contains(&w("08-02").to_string()))
-        );
-    }
-
-    /// The 2026-08-22 shape: one weekly, three dailies, 39 hourlies spread over them. Only the two
-    /// newest of each incremental strategy stay — a fresh clone downloads 5 bundles, not 43 — and the
-    /// one that was newest a slot ago is still listed (a client mid-chain never 404s on it).
-    #[test]
-    fn retention_drops_everything_but_the_two_newest_incrementals_and_keeps_last_slots_bundle() {
-        let c = cfg();
-        let mut list = BundleList::default();
-        let w0 = epoch(t("2026-08-16T23:00:00Z"));
-        list.bundles.push(entry("weekly", w0, ""));
-        let mut dailies = Vec::new();
-        for day in ["08-17", "08-18", "08-19"] {
-            let ds = epoch(t(&format!("2026-{day}T23:00:00Z")));
-            list.bundles
-                .push(entry("daily", ds, &format!("weekly-{w0}")));
-            dailies.push(ds);
-        }
-        // 13 hourlies on each daily (01:00..13:00 the next day).
-        for ds in &dailies {
-            for h in 2..=14u64 {
-                list.bundles
-                    .push(entry("hourly", ds + h * 3600, &format!("daily-{ds}")));
-            }
-        }
-        assert_eq!(list.bundles.len(), 1 + 3 + 39);
-        let newest_hourly = format!("hourly-{}", dailies[2] + 14 * 3600);
-        let previous_hourly = format!("hourly-{}", dailies[2] + 13 * 3600);
-        let pruned = retain(&c, &mut list);
-        let kept: Vec<&str> = list.bundles.iter().map(|b| b.id.as_str()).collect();
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "weekly")
-                .count(),
-            1
-        );
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "daily")
-                .count(),
-            2
-        );
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "hourly")
-                .count(),
-            2
-        );
-        assert_eq!(kept.len(), 5, "{kept:?}");
-        assert_eq!(pruned.len(), 38);
-        assert!(
-            kept.contains(&newest_hourly.as_str()) && kept.contains(&previous_hourly.as_str()),
-            "{kept:?}"
-        );
-        assert!(
-            kept.contains(&format!("daily-{}", dailies[2]).as_str())
-                && kept.contains(&format!("daily-{}", dailies[1]).as_str())
-        );
-        // Next slot arrives: the bundle that was newest is still listed, the one before it goes.
-        let next = dailies[2] + 15 * 3600;
-        list.bundles
-            .push(entry("hourly", next, &format!("daily-{}", dailies[2])));
-        let pruned = retain(&c, &mut list);
-        assert_eq!(
-            pruned,
-            vec![format!("bundles/hourly/{}.bundle", dailies[2] + 13 * 3600)]
-        );
-        assert!(list.bundles.iter().any(|b| b.id == newest_hourly));
-        // Orphans never survive: an hourly whose daily is gone goes too, even if it is among the newest.
-        let mut c1 = cfg();
-        c1.strategy[0].keep = 1;
-        let w1 = epoch(t("2026-08-23T23:00:00Z"));
-        list.bundles.push(entry("weekly", w1, ""));
-        list.bundles
-            .push(entry("daily", w1 + 86_400, &format!("weekly-{w1}")));
-        // keep=1 weekly → weekly-w0 and its dailies go → their hourlies go, whatever their age.
-        retain(&c1, &mut list);
-        assert!(
-            list.bundles.iter().all(|b| b.strategy != "hourly"),
-            "{:?}",
-            list.bundles.iter().map(|b| &b.id).collect::<Vec<_>>()
-        );
-        assert_eq!(
-            list.bundles
-                .iter()
-                .filter(|b| b.strategy == "daily")
-                .count(),
-            1
-        );
-    }
-
-    #[test]
-    fn default_refs_are_main_only_unless_configured() {
-        let mut c = cfg();
-        assert_eq!(
-            default_refs(&c, &c.strategy[0]),
-            vec!["HEAD", "refs/heads/main"]
-        );
-        c.extra_refs = vec!["refs/tags/v*".into()];
-        assert_eq!(
-            default_refs(&c, &c.strategy[0]),
-            vec!["HEAD", "refs/heads/main", "refs/tags/v*"]
-        );
-        c.main_only = false;
-        assert_eq!(
-            default_refs(&c, &c.strategy[0]),
-            vec!["refs/heads/*", "refs/tags/*", "HEAD", "refs/tags/v*"]
-        );
-        let mut s = c.strategy[0].clone();
-        s.refs = vec!["refs/heads/release-*".into()];
-        assert_eq!(default_refs(&c, &s), vec!["refs/heads/release-*"]);
-    }
-
-    /// A repository's first day: a weekly exists, no daily yet. Hourlies are not
-    /// blocked — they resolve their base up the chain to the weekly (and the
-    /// builder would cut them with the weekly's tips as prerequisites); the
-    /// missing dailies are planned as usual. Prod 2026-08-21: a large repository's hourlies
-    /// only existed because a header-only legacy daily sat in the list.
-    #[test]
-    fn hourlies_fall_back_to_the_weekly_when_no_daily_exists_yet() {
-        let c = cfg();
-        let w0 = epoch(t("2026-08-16T23:00:00Z")); // Sunday
-        let mut list = BundleList::default();
-        list.bundles.push(entry("weekly", w0, ""));
-        let now = t("2026-08-17T12:30:00Z"); // Monday midday: no daily slot (23:00) has passed
-        let rows = plan(&c, &list, now, true).unwrap();
-        let hourly: Vec<&SlotPlan> = rows.iter().filter(|r| r.strategy == "hourly").collect();
-        assert_eq!(hourly.len(), INCREMENTALS_KEPT, "{rows:?}");
-        assert!(
-            hourly.iter().all(|r| r.status == SlotStatus::Missing),
-            "{hourly:?}"
-        );
-        assert!(
-            hourly
-                .iter()
-                .all(|r| r.base_id.as_deref() == Some(format!("weekly-{w0}").as_str())),
-            "{hourly:?}"
-        );
-        assert_eq!(
-            hourly.first().unwrap().slot,
-            epoch(t("2026-08-17T11:00:00Z"))
-        );
-        assert_eq!(
-            hourly.last().unwrap().slot,
-            epoch(t("2026-08-17T12:00:00Z"))
-        );
-        assert_eq!(
-            base_for_slot_chain(&c, &list, "daily", epoch(t("2026-08-17T05:00:00Z")))
-                .map(|b| b.id.as_str()),
-            Some(format!("weekly-{w0}").as_str())
-        );
-        // Once Monday's daily exists, Tuesday's hourlies chain to it, Monday's stay on the weekly.
-        let d1 = epoch(t("2026-08-17T23:00:00Z"));
-        list.bundles
-            .push(entry("daily", d1, &format!("weekly-{w0}")));
-        let rows = plan(&c, &list, t("2026-08-18T03:30:00Z"), true).unwrap();
-        let tue3 = rows
-            .iter()
-            .find(|r| r.strategy == "hourly" && r.slot == epoch(t("2026-08-18T03:00:00Z")))
-            .unwrap();
-        assert_eq!(
-            tue3.base_id.as_deref(),
-            Some(format!("daily-{d1}").as_str())
-        );
-        // Monday 05:00 is neither built nor among the two newest slots: not planned at all.
-        assert!(
-            rows.iter()
-                .all(|r| !(r.strategy == "hourly" && r.slot == epoch(t("2026-08-17T05:00:00Z"))))
-        );
-    }
-}
diff --git a/crates/walgit-bundle/tests/bundle.rs b/crates/walgit-bundle/tests/bundle.rs
deleted file mode 100644
index c0118c0..0000000
--- a/crates/walgit-bundle/tests/bundle.rs
+++ /dev/null
@@ -1,1131 +0,0 @@
-// Test fixtures use panics to fail the test, including shared helper functions.
-#![allow(
-    clippy::panic,
-    clippy::string_slice,
-    clippy::unwrap_used,
-    clippy::field_reassign_with_default,
-    clippy::cast_sign_loss
-)]
-
-//! Integration tests for walgit-bundle: real upstream `git` + `MemoryStore`.
-//!
-//! These tests create bare repos via `LocalRepo::init`, push commits from a
-//! working clone, and exercise the full bundler flow:
-//!   - Full bundle passes `git bundle verify`
-//!   - Incremental bundle has prerequisites
-//!   - `git clone` from full + `git fetch` incremental → identical refs
-//!   - `run_due` respects schedule and lease
-//!   - Pruning keeps the chain valid
-//!   - `--bundle-uri` clone works from a file:// bundle list
-
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{Duration, SystemTime, UNIX_EPOCH};
-
-use tempfile::TempDir;
-use tokio::process::Command;
-
-use walgit_bundle::{
-    BundleEngine, BundleError, BundleRepoHandle, BundleSource, Bundler, RepoId, ops,
-};
-use walgit_config::{BundleKind, BundleServe, BundleStrategy, BundlesConfig, ByteSize, Config};
-use walgit_git::{LocalRepo, ObjectFormat as GitObjectFormat};
-use walgit_store::{DynStore, ObjectStore, ObjectStoreExt, Prefixed, memory::MemoryStore};
-
-// ---------------------------------------------------------------------------
-// Test helpers
-// ---------------------------------------------------------------------------
-
-struct TestRepo {
-    local: LocalRepo,
-    store: Prefixed,
-    head_seq: Arc<AtomicU64>,
-    work_path: PathBuf,
-    _root: TempDir,
-}
-
-impl TestRepo {
-    async fn new(owner: &str, name: &str) -> Self {
-        let root = tempfile::tempdir().unwrap();
-        let id = RepoId::new(owner, name).unwrap();
-
-        // Init bare repo.
-        let local = LocalRepo::init(root.path(), &id, GitObjectFormat::Sha1).unwrap();
-        let bare_path = id.local_dir(root.path());
-
-        // Create working clone.
-        let work_path = root.path().join("work");
-        tokio::fs::create_dir_all(&work_path).await.unwrap();
-        run_git(&work_path, &["init", "--initial-branch=main"]).await;
-        run_git(&work_path, &["config", "user.email", "test@test.com"]).await;
-        run_git(&work_path, &["config", "user.name", "Test"]).await;
-        run_git(
-            &work_path,
-            &["remote", "add", "origin", bare_path.to_str().unwrap()],
-        )
-        .await;
-
-        // Memory store scoped to the repo prefix.
-        let mem = Arc::new(MemoryStore::new()) as DynStore;
-        let store = Prefixed::new(mem, id.store_prefix());
-
-        TestRepo {
-            local,
-            store,
-            head_seq: Arc::new(AtomicU64::new(0)),
-            work_path,
-            _root: root,
-        }
-    }
-
-    async fn commit(&self, msg: &str) {
-        let ts = SystemTime::now()
-            .duration_since(UNIX_EPOCH)
-            .unwrap()
-            .as_nanos();
-        let file = self.work_path.join(format!("file-{ts}.txt"));
-        tokio::fs::write(&file, format!("content {ts}"))
-            .await
-            .unwrap();
-        run_git(&self.work_path, &["add", "."]).await;
-        run_git(&self.work_path, &["commit", "-m", msg]).await;
-    }
-
-    async fn tag(&self, name: &str, msg: &str) {
-        run_git(&self.work_path, &["tag", "-a", name, "-m", msg]).await;
-    }
-
-    async fn push(&self) {
-        run_git(&self.work_path, &["push", "origin", "main", "--tags"]).await;
-        self.local.refresh().unwrap();
-    }
-
-    fn advance_seq(&self) {
-        self.head_seq.fetch_add(1, Ordering::Relaxed);
-    }
-}
-
-/// Test `BundleSource`: holds one or more repos.
-struct TestSource {
-    repos: HashMap<RepoId, (LocalRepo, Prefixed, Arc<AtomicU64>)>,
-}
-
-impl TestSource {
-    fn new() -> Self {
-        TestSource {
-            repos: HashMap::new(),
-        }
-    }
-
-    fn add(&mut self, tr: &TestRepo, id: RepoId) {
-        self.repos.insert(
-            id,
-            (tr.local.clone(), tr.store.clone(), tr.head_seq.clone()),
-        );
-    }
-}
-
-#[async_trait::async_trait]
-impl BundleSource for TestSource {
-    async fn open_repo(&self, id: &RepoId) -> Result<BundleRepoHandle, BundleError> {
-        let (local, store, head_seq) = self
-            .repos
-            .get(id)
-            .ok_or_else(|| BundleError::RepoNotFound(id.to_string()))?;
-        Ok(BundleRepoHandle {
-            local: local.clone(),
-            store: store.clone(),
-            head_seq: head_seq.load(Ordering::Relaxed),
-            engine: BundleEngine::default(),
-            cfg: None,
-        })
-    }
-
-    async fn list_repos(&self) -> Result<Vec<RepoId>, BundleError> {
-        Ok(self.repos.keys().cloned().collect())
-    }
-}
-
-/// Run a git command in `cwd`, panicking on failure.
-async fn run_git(cwd: &Path, args: &[&str]) -> String {
-    let output = Command::new("git")
-        .args(args)
-        .current_dir(cwd)
-        .output()
-        .await
-        .unwrap_or_else(|e| panic!("git {args:?}: {e}"));
-    assert!(
-        output.status.success(),
-        "git {:?} failed: {}",
-        args,
-        String::from_utf8_lossy(&output.stderr)
-    );
-    String::from_utf8_lossy(&output.stdout).to_string()
-}
-
-/// Config with a single full strategy "weekly".
-fn cfg_full_only(keep: usize) -> Config {
-    let mut cfg = Config::default();
-    cfg.bundles = BundlesConfig {
-        enabled: true,
-        strategy: vec![BundleStrategy {
-            name: "weekly".into(),
-            kind: BundleKind::Full,
-            schedule: "@weekly".into(),
-            base: None,
-            keep,
-            refs: vec![],
-            backfill_max: 0,
-            min_commits: None,
-            filter: None,
-            chain: false,
-        }],
-        min_commits: 0,
-        min_bytes: ByteSize::default(),
-        serve_via: BundleServe::Proxy,
-        signed_url_ttl: Duration::from_hours(1),
-        advertise: true,
-        advertise_filtered: false,
-        require: Vec::new(),
-        signed_url_for: Vec::new(),
-        main_only: false,
-        extra_refs: Vec::new(),
-    };
-    cfg
-}
-
-/// Config with weekly (full) + daily (incremental based on weekly).
-fn cfg_weekly_daily(keep_full: usize, keep_inc: usize) -> Config {
-    let mut cfg = Config::default();
-    cfg.bundles = BundlesConfig {
-        enabled: true,
-        strategy: vec![
-            BundleStrategy {
-                name: "weekly".into(),
-                kind: BundleKind::Full,
-                schedule: "@weekly".into(),
-                base: None,
-                keep: keep_full,
-                refs: vec![],
-                backfill_max: 0,
-                min_commits: None,
-                filter: None,
-                chain: false,
-            },
-            BundleStrategy {
-                name: "daily".into(),
-                kind: BundleKind::Incremental,
-                schedule: "@daily".into(),
-                base: Some("weekly".into()),
-                keep: keep_inc,
-                refs: vec![],
-                backfill_max: 0,
-                min_commits: None,
-                filter: None,
-                chain: false,
-            },
-        ],
-        min_commits: 0,
-        min_bytes: ByteSize::default(),
-        serve_via: BundleServe::Proxy,
-        signed_url_ttl: Duration::from_hours(1),
-        advertise: true,
-        advertise_filtered: false,
-        require: Vec::new(),
-        signed_url_for: Vec::new(),
-        main_only: false,
-        extra_refs: Vec::new(),
-    };
-    cfg
-}
-
-/// Download a bundle from the store to a tempdir at the path matching a
-/// `file://<base>/<owner>/<repo>/<key>` URI.
-async fn download_bundle_to(
-    store: &Prefixed,
-    key: &str,
-    base_dir: &Path,
-    owner: &str,
-    repo: &str,
-) -> PathBuf {
-    let (_, data) = store
-        .get_bytes(key)
-        .await
-        .unwrap()
-        .unwrap_or_else(|| panic!("bundle not found: {key}"));
-    // The file:// URI is file://<base>/<owner>/<repo>/<key>
-    // So the file path is <base>/<owner>/<repo>/<key>
-    let file_path = base_dir.join(owner).join(repo).join(key);
-    if let Some(parent) = file_path.parent() {
-        tokio::fs::create_dir_all(parent).await.unwrap();
-    }
-    tokio::fs::write(&file_path, &data).await.unwrap();
-    file_path
-}
-
-/// Get refs from a repo as a sorted list of "name oid" strings.
-async fn get_refs(repo_path: &Path) -> Vec<String> {
-    let output = Command::new("git")
-        .args(["for-each-ref", "--format=%(refname) %(objectname)"])
-        .current_dir(repo_path)
-        .output()
-        .await
-        .unwrap();
-    let s = String::from_utf8_lossy(&output.stdout);
-    let mut refs: Vec<String> = s.lines().map(std::string::ToString::to_string).collect();
-    refs.sort();
-    refs
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-#[tokio::test]
-async fn full_bundle_passes_verify() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial commit").await;
-    tr.commit("second commit").await;
-    tr.tag("v1.0", "version 1.0").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_full_only(4));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    let entry = bundler.build(&id, "weekly").await.unwrap();
-
-    // Download the bundle and verify.
-    let (_, data) = tr.store.get_bytes(&entry.key).await.unwrap().unwrap();
-    let bundle_file = tempfile::tempdir().unwrap();
-    let bundle_path = bundle_file.path().join("bundle.bundle");
-    tokio::fs::write(&bundle_path, &data).await.unwrap();
-
-    // `git bundle verify` needs a repository to run in (any will do: it checks the bundle's
-    // own prerequisites); never rely on the test's cwd being one.
-    let scratch = bundle_file.path().join("scratch");
-    assert!(
-        Command::new("git")
-            .args(["init", "-q", "--bare"])
-            .arg(&scratch)
-            .status()
-            .await
-            .unwrap()
-            .success()
-    );
-    let output = Command::new("git")
-        .arg("-C")
-        .arg(&scratch)
-        .args(["bundle", "verify"])
-        .arg(&bundle_path)
-        .output()
-        .await
-        .unwrap();
-    assert!(
-        output.status.success(),
-        "git bundle verify failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    // Entry should have tips.
-    assert!(!entry.tips.is_empty(), "bundle entry should have tips");
-    assert!(entry.tips.iter().any(|t| t.name == "refs/heads/main"));
-    assert!(entry.tips.iter().any(|t| t.name == "refs/tags/v1.0"));
-    assert_eq!(entry.kind, "full");
-    assert!(entry.base_id.is_empty());
-}
-
-#[tokio::test]
-async fn incremental_has_prerequisites() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_weekly_daily(4, 7));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    // Build the base (weekly) first.
-    let base_entry = bundler.build(&id, "weekly").await.unwrap();
-    assert_eq!(base_entry.kind, "full");
-
-    // Add new commits and advance seq.
-    tr.commit("new commit 1").await;
-    tr.commit("new commit 2").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    // Build incremental (daily).
-    let inc_entry = bundler.build(&id, "daily").await.unwrap();
-    assert_eq!(inc_entry.kind, "incremental");
-    assert_eq!(inc_entry.base_id, base_entry.id);
-
-    // Download and verify the incremental bundle has prerequisites.
-    let (_, data) = tr.store.get_bytes(&inc_entry.key).await.unwrap().unwrap();
-    let bundle_file = tempfile::tempdir().unwrap();
-    let bundle_path = bundle_file.path().join("incremental.bundle");
-    tokio::fs::write(&bundle_path, &data).await.unwrap();
-
-    // git bundle verify should pass.
-    let output = Command::new("git")
-        .args(["bundle", "verify"])
-        .arg(&bundle_path)
-        .current_dir(tr.local.path())
-        .output()
-        .await
-        .unwrap();
-    assert!(
-        output.status.success(),
-        "incremental bundle verify failed: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    // Bundle header ends at the first blank line; the pack is binary after that.
-    let header = String::from_utf8_lossy(&data);
-    let header_lines: Vec<&str> = header.lines().take_while(|l| !l.is_empty()).collect();
-    let prereqs: Vec<&str> = header_lines
-        .iter()
-        .filter_map(|l| l.strip_prefix('-'))
-        .filter_map(|rest| rest.split_whitespace().next())
-        .collect();
-    assert!(
-        !prereqs.is_empty(),
-        "incremental bundle should have prerequisites in header"
-    );
-
-    // The prerequisites should match the base bundle's tips.
-    let base_tips: Vec<&str> = base_entry.tips.iter().map(|t| t.oid.as_str()).collect();
-    for oid in prereqs {
-        assert!(
-            base_tips.contains(&oid),
-            "prerequisite {oid} should be in base tips {base_tips:?}"
-        );
-    }
-}
-
-#[tokio::test]
-async fn clone_from_full_then_fetch_incremental() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial commit").await;
-    tr.commit("second commit").await;
-    tr.tag("v1.0", "version 1").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_weekly_daily(4, 7));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    // Build full bundle.
-    let full_entry = bundler.build(&id, "weekly").await.unwrap();
-
-    // Add more commits.
-    tr.commit("third commit").await;
-    tr.tag("v2.0", "version 2").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    // Build incremental bundle.
-    let inc_entry = bundler.build(&id, "daily").await.unwrap();
-
-    // Download both bundles.
-    let bundle_dir = tempfile::tempdir().unwrap();
-    let (_, full_data) = tr.store.get_bytes(&full_entry.key).await.unwrap().unwrap();
-    let full_path = bundle_dir.path().join("full.bundle");
-    tokio::fs::write(&full_path, &full_data).await.unwrap();
-
-    let (_, inc_data) = tr.store.get_bytes(&inc_entry.key).await.unwrap().unwrap();
-    let inc_path = bundle_dir.path().join("inc.bundle");
-    tokio::fs::write(&inc_path, &inc_data).await.unwrap();
-
-    // Clone from the full bundle as a bare repo (so we can fetch into refs/heads/*).
-    let clone_dir = tempfile::tempdir().unwrap();
-    let clone_path = clone_dir.path().join("clone.git");
-    run_git(
-        clone_dir.path(),
-        &[
-            "clone",
-            "--bare",
-            full_path.to_str().unwrap(),
-            clone_path.to_str().unwrap(),
-        ],
-    )
-    .await;
-
-    // Fetch the incremental bundle into the clone, updating local refs.
-    run_git(
-        &clone_path,
-        &[
-            "fetch",
-            inc_path.to_str().unwrap(),
-            "refs/heads/main:refs/heads/main",
-            "refs/tags/*:refs/tags/*",
-        ],
-    )
-    .await;
-
-    // Compare refs: clone should have all refs from the original repo.
-    let original_refs = get_refs(tr.local.path()).await;
-    let clone_refs = get_refs(&clone_path).await;
-
-    // The clone should have the same branch and tags.
-    let original_main = original_refs
-        .iter()
-        .find(|r| r.starts_with("refs/heads/main"))
-        .cloned();
-    let clone_main = clone_refs
-        .iter()
-        .find(|r| r.starts_with("refs/heads/main"))
-        .cloned();
-    assert_eq!(
-        original_main, clone_main,
-        "main branch should match after fetch"
-    );
-
-    for tag in &original_refs {
-        if tag.starts_with("refs/tags/") {
-            let tag_name = tag.split_whitespace().next().unwrap();
-            let clone_tag = clone_refs.iter().find(|r| r.starts_with(tag_name)).cloned();
-            assert_eq!(
-                Some(tag.clone()),
-                clone_tag,
-                "tag {tag_name} should match after fetch"
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn run_due_respects_schedule_and_lease() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_full_only(4));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    let now = SystemTime::now();
-
-    // First run: never built → due → should build.
-    let built = bundler.run_due(&id, now).await.unwrap();
-    assert_eq!(built.len(), 1, "should build one bundle (never built)");
-    assert_eq!(built[0].strategy, "weekly");
-
-    // Second run at same time: head_seq unchanged → skip.
-    let built2 = bundler.run_due(&id, now).await.unwrap();
-    assert!(built2.is_empty(), "should skip (head_seq unchanged)");
-
-    // Add commits and advance seq.
-    tr.commit("new commit").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    // Third run: head_seq changed, schedule still due (weekly, but last built
-    // was just now — next fire is a week away, so NOT due by schedule).
-    // Wait — @weekly means next fire is ~1 week away. So it shouldn't be due.
-    let built3 = bundler.run_due(&id, now).await.unwrap();
-    assert!(
-        built3.is_empty(),
-        "should skip (not due by schedule: @weekly next fire is a week away)"
-    );
-
-    // Fourth run: advance just past the next weekly calendar slot. Adding a
-    // fixed eight days can cross two slots, depending on the current weekday.
-    let schedule = walgit_bundle::schedule::parse_schedule("@weekly").unwrap();
-    let future =
-        walgit_bundle::schedule::next_fire_after(&schedule, now).unwrap() + Duration::from_secs(1);
-    let built4 = bundler.run_due(&id, future).await.unwrap();
-    assert_eq!(
-        built4.len(),
-        1,
-        "should build (due by schedule after the next weekly slot)"
-    );
-
-    // Lease test: hold the lease, run_due should skip.
-    tr.commit("another commit").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let future2 = walgit_bundle::schedule::next_fire_after(&schedule, future).unwrap()
-        + Duration::from_secs(1);
-    ops::hold_lease(&tr.store, "weekly", "test-holder", Duration::from_mins(1))
-        .await
-        .unwrap();
-    let built5 = bundler.run_due(&id, future2).await.unwrap();
-    assert!(
-        built5.is_empty(),
-        "should skip (lease held by another holder)"
-    );
-}
-
-#[tokio::test]
-async fn pruning_keeps_chain_valid() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    // Config: keep only 2 full bundles, 3 daily incrementals.
-    let cfg = Arc::new(cfg_weekly_daily(2, 3));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    let now = SystemTime::now();
-
-    // Build 3 full bundles (each time advancing seq).
-    for i in 0..3 {
-        if i > 0 {
-            tr.commit(&format!("commit {i}")).await;
-            tr.push().await;
-            tr.advance_seq();
-        }
-        let future = now + Duration::from_secs((i as u64) * 8 * 24 * 3600);
-        bundler.run_due(&id, future).await.unwrap();
-    }
-
-    // Check the list: should have only 2 weekly bundles (keep=2).
-    let list = ops::read_list(&tr.store).await.unwrap().unwrap();
-    let weekly: Vec<_> = list
-        .bundles
-        .iter()
-        .filter(|b| b.strategy == "weekly")
-        .collect();
-    assert_eq!(weekly.len(), 2, "should keep 2 weekly bundles");
-
-    // The oldest weekly bundle's object should be deleted from the store.
-    // (We built 3, kept 2, so 1 should be pruned.)
-    // Check that all kept bundle objects still exist.
-    for b in &list.bundles {
-        assert!(
-            tr.store.head(&b.key).await.unwrap().is_some(),
-            "kept bundle should exist: {}",
-            b.key
-        );
-    }
-}
-
-#[tokio::test]
-async fn bundle_uri_clone_works() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial commit").await;
-    tr.commit("second commit").await;
-    tr.tag("v1.0", "version 1").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_full_only(4));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    // Build a full bundle.
-    let entry = bundler.build(&id, "weekly").await.unwrap();
-
-    // Download the bundle to a tempdir at the path matching the file:// URI.
-    let bundles_dir = tempfile::tempdir().unwrap();
-    let _bundle_path =
-        download_bundle_to(&tr.store, &entry.key, bundles_dir.path(), "test", "repo").await;
-
-    // Render the bundle list with file:// base_url.
-    let base_url = format!("file://{}", bundles_dir.path().display());
-    let list_text = bundler
-        .render_list(&id, &base_url, None, true)
-        .await
-        .unwrap()
-        .unwrap();
-
-    // Write the list to a config file.
-    let list_file = bundles_dir.path().join("bundle-list");
-    tokio::fs::write(&list_file, &list_text).await.unwrap();
-
-    // git clone --bundle-uri=<list-file> <bare-repo> <target>
-    let clone_dir = tempfile::tempdir().unwrap();
-    let clone_path = clone_dir.path().join("clone");
-    let output = Command::new("git")
-        .args([
-            "-c",
-            "transfer.bundleURI=true",
-            "clone",
-            "--bundle-uri",
-            list_file.to_str().unwrap(),
-            tr.local.path().to_str().unwrap(),
-            clone_path.to_str().unwrap(),
-        ])
-        .output()
-        .await
-        .unwrap();
-
-    assert!(
-        output.status.success(),
-        "git clone --bundle-uri failed:\nstdout: {}\nstderr: {}",
-        String::from_utf8_lossy(&output.stdout),
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    // Verify the clone has the correct refs.
-    let clone_refs = get_refs(&clone_path).await;
-    let original_refs = get_refs(tr.local.path()).await;
-
-    let clone_main = clone_refs
-        .iter()
-        .find(|r| r.starts_with("refs/heads/main"))
-        .cloned();
-    let original_main = original_refs
-        .iter()
-        .find(|r| r.starts_with("refs/heads/main"))
-        .cloned();
-    assert_eq!(clone_main, original_main, "main branch should match");
-
-    for tag in &original_refs {
-        if tag.starts_with("refs/tags/") {
-            let tag_name = tag.split_whitespace().next().unwrap();
-            let clone_tag = clone_refs.iter().find(|r| r.starts_with(tag_name)).cloned();
-            assert_eq!(
-                Some(tag.clone()),
-                clone_tag,
-                "tag {tag_name} should match in clone"
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn run_all_due_multiple_repos() {
-    let tr1 = TestRepo::new("owner1", "repo1").await;
-    tr1.commit("init").await;
-    tr1.push().await;
-    tr1.advance_seq();
-
-    let tr2 = TestRepo::new("owner2", "repo2").await;
-    tr2.commit("init").await;
-    tr2.push().await;
-    tr2.advance_seq();
-
-    let id1 = RepoId::new("owner1", "repo1").unwrap();
-    let id2 = RepoId::new("owner2", "repo2").unwrap();
-
-    let mut source = TestSource::new();
-    source.add(&tr1, id1.clone());
-    source.add(&tr2, id2.clone());
-
-    let cfg = Arc::new(cfg_full_only(4));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    let now = SystemTime::now();
-    bundler.run_all_due(now).await.unwrap();
-
-    // Both repos should have a bundle.
-    let list1 = ops::read_list(&tr1.store).await.unwrap().unwrap();
-    assert_eq!(list1.bundles.len(), 1);
-
-    let list2 = ops::read_list(&tr2.store).await.unwrap().unwrap();
-    assert_eq!(list2.bundles.len(), 1);
-}
-
-#[tokio::test]
-async fn render_list_and_protocol_v2_consistency() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_full_only(4));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    bundler.build(&id, "weekly").await.unwrap();
-
-    let base_url = "https://example.com";
-    let list_text = bundler
-        .render_list(&id, base_url, None, true)
-        .await
-        .unwrap()
-        .unwrap();
-    let v2_lines = bundler.protocol_v2_lines(&id, base_url).await.unwrap();
-
-    // Both should mention the same URI and creationToken.
-    assert!(list_text.contains("version = 1"));
-    assert!(list_text.contains("mode = all"));
-    assert!(list_text.contains("heuristic = creationToken"));
-
-    assert!(v2_lines.contains(&"bundle.version=1".to_string()));
-    assert!(v2_lines.contains(&"bundle.mode=all".to_string()));
-    assert!(v2_lines.contains(&"bundle.heuristic=creationToken".to_string()));
-
-    // Extract URI from both and compare.
-    let config_uri = list_text
-        .lines()
-        .find(|l| l.trim_start().starts_with("uri ="))
-        .unwrap()
-        .trim_start_matches("    uri = ")
-        .to_string();
-    let v2_uri = v2_lines
-        .iter()
-        .find(|l| l.contains(".uri="))
-        .unwrap()
-        .split('=')
-        .nth(1)
-        .unwrap()
-        .to_string();
-    assert_eq!(config_uri, v2_uri, "URI should match between config and v2");
-}
-
-#[tokio::test]
-async fn incremental_builds_base_if_absent() {
-    let tr = TestRepo::new("test", "repo").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "repo").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let cfg = Arc::new(cfg_weekly_daily(4, 7));
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg);
-
-    // Build the base (weekly) first.
-    bundler.build(&id, "weekly").await.unwrap();
-
-    // Add a new commit so the incremental has new objects.
-    tr.commit("new commit for daily").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    // Now build daily — base already exists.
-    let entry = bundler.build(&id, "daily").await.unwrap();
-    assert_eq!(entry.kind, "incremental");
-    assert!(!entry.base_id.is_empty(), "should have a base_id");
-
-    // The list should contain both weekly and daily.
-    let list = ops::read_list(&tr.store).await.unwrap().unwrap();
-    assert!(
-        list.bundles.iter().any(|b| b.strategy == "weekly"),
-        "weekly should be built"
-    );
-    assert!(
-        list.bundles.iter().any(|b| b.strategy == "daily"),
-        "daily should be built"
-    );
-}
-
-/// Minimum-size gate: an incremental with fewer than `min_commits` commits
-/// since its base is not cut (`TooSmall`, plan state `too-small`); once enough
-/// commits exist the same strategy builds on the same base. Fulls are never
-/// gated.
-#[tokio::test]
-async fn min_commits_gate_skips_small_incrementals() {
-    let tr = TestRepo::new("test", "gate").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-
-    let id = RepoId::new("test", "gate").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-
-    let mut cfg = cfg_weekly_daily(4, 7);
-    cfg.bundles.min_commits = 3;
-    let cfg = Arc::new(cfg);
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg.clone());
-
-    // Full is never gated (1 commit).
-    let base = bundler.build(&id, "weekly").await.unwrap();
-    assert_eq!(base.kind, "full");
-
-    // 2 commits since base < 3 → too small.
-    tr.commit("a").await;
-    tr.commit("b").await;
-    tr.push().await;
-    tr.advance_seq();
-    match bundler.build(&id, "daily").await {
-        Err(walgit_bundle::BundleError::TooSmall { commits, min }) => {
-            assert_eq!((commits, min), (2, 3));
-        }
-        other => panic!("expected TooSmall, got {:?}", other.map(|e| e.id)),
-    }
-    // The plan shows it as too-small for the measured slot (slot 0 = "now" build path keyed by cut.slot=0),
-    // and no bundle was recorded.
-    let rows = bundler
-        .plan(
-            &id,
-            std::time::SystemTime::now(),
-            walgit_bundle::slots::PlanContext {
-                first_state: None,
-                can_full: true,
-                can_incremental: true,
-                wrong_host_reason: None,
-            },
-        )
-        .await
-        .unwrap();
-    assert!(rows.iter().all(|r| !(r.strategy == "daily"
-        && matches!(r.status, walgit_bundle::slots::SlotStatus::Built { .. }))));
-
-    // One more commit → 3 ≥ 3 → built on the same base.
-    tr.commit("c").await;
-    tr.push().await;
-    tr.advance_seq();
-    let inc = bundler.build(&id, "daily").await.unwrap();
-    assert_eq!(inc.base_id, base.id);
-}
-
-/// D22: content is the state AS OF the slot. When the source knows no state at
-/// the slot (`refs_as_of` = None), the first full is cut from the earliest state
-/// there is, but an incremental is NOT cut from "now" — prod 2026-08-21: eight
-/// "08-19/08-20" dailies/hourlies were published with 04:2xZ content under
-/// old tokens.
-#[tokio::test]
-async fn incremental_slot_without_state_is_not_cut_from_now() {
-    let tr = TestRepo::new("test", "asof").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-    let id = RepoId::new("test", "asof").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-    let mut cfg = cfg_weekly_daily(4, 7);
-    cfg.bundles.min_commits = 1;
-    let bundler = Bundler::new_with_source(Arc::new(source), Arc::new(cfg));
-
-    // TestSource::refs_as_of is None for every instant.
-    let old_slot = 1_787_180_400u64; // 2026-08-19 23:00Z
-    let weekly = bundler
-        .build_slot_unit(&id, "weekly", old_slot)
-        .await
-        .unwrap();
-    assert!(
-        weekly.is_some(),
-        "the first full is cut from the earliest state"
-    );
-    for _ in 0..3 {
-        tr.commit("later").await;
-    }
-    tr.push().await;
-    tr.advance_seq();
-    let daily = bundler
-        .build_slot_unit(&id, "daily", old_slot + 3600)
-        .await
-        .unwrap();
-    assert!(
-        daily.is_none(),
-        "no state as of the slot: an incremental is not cut"
-    );
-    let list = ops::read_list(&tr.store).await.unwrap().unwrap();
-    assert!(
-        list.bundles.iter().all(|b| b.strategy != "daily"),
-        "{:?}",
-        list.bundles.iter().map(|b| &b.id).collect::<Vec<_>>()
-    );
-}
-
-/// A closed slot measured under the gate is recorded in the list and planned as
-/// `skipped` from then on — by any host, across restarts, in O(1) — instead of
-/// being re-measured every pass (after a restart the SSD host re-walked ~30 such
-/// slots before reaching the live hour, 2026-08-21). A new base bundle for the
-/// slot re-opens the question; the live (open) slot is never recorded.
-#[tokio::test]
-async fn too_small_closed_slots_are_recorded_and_skipped_not_remeasured() {
-    let tr = TestRepo::new("test", "skip").await;
-    tr.commit("initial").await;
-    tr.push().await;
-    tr.advance_seq();
-    let id = RepoId::new("test", "skip").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-    let mut cfg = cfg_weekly_daily(4, 7);
-    cfg.bundles.min_commits = 1000; // everything is too small
-    let cfg = Arc::new(cfg);
-    let bundler = Bundler::new_with_source(Arc::new(source), cfg.clone());
-    // A closed daily slot (yesterday 23:00) on a weekly cut at the Sunday before it.
-    let now = std::time::SystemTime::now();
-    let daily_strat = cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "daily")
-        .unwrap();
-    // The newest CLOSED daily slot: the one before the latest fire.
-    let latest = walgit_bundle::slots::last_slot_at_or_before(daily_strat, now)
-        .unwrap()
-        .unwrap();
-    let yesterday = walgit_bundle::slots::last_slot_at_or_before(
-        daily_strat,
-        walgit_bundle::slots::from_epoch(latest - 1),
-    )
-    .unwrap()
-    .unwrap();
-    assert!(walgit_bundle::slots::slot_closed(
-        daily_strat,
-        yesterday,
-        now
-    ));
-    let weekly_strat = cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "weekly")
-        .unwrap();
-    let sunday = walgit_bundle::slots::last_slot_at_or_before(
-        weekly_strat,
-        walgit_bundle::slots::from_epoch(yesterday),
-    )
-    .unwrap()
-    .unwrap();
-    let weekly = bundler
-        .build_slot_unit(&id, "weekly", sunday)
-        .await
-        .unwrap()
-        .expect("weekly cut from the earliest state");
-
-    assert!(
-        bundler
-            .build_slot_unit(&id, "daily", yesterday)
-            .await
-            .unwrap()
-            .is_none()
-    );
-    let list = ops::read_list(&tr.store).await.unwrap().unwrap();
-    assert_eq!(list.skipped.len(), 1, "{:?}", list.skipped);
-    assert_eq!(
-        (
-            list.skipped[0].strategy.as_str(),
-            list.skipped[0].slot,
-            list.skipped[0].base_id.as_str()
-        ),
-        ("daily", yesterday, weekly.id.as_str())
-    );
-    assert!(
-        list.skipped[0].reason.starts_with("too-small")
-            || list.skipped[0].reason.starts_with("no state"),
-        "{}",
-        list.skipped[0].reason
-    );
-    // Planned as skipped now — no host measures it again; recording is idempotent.
-    let ctx = walgit_bundle::slots::PlanContext {
-        first_state: None,
-        can_full: true,
-        can_incremental: true,
-        wrong_host_reason: None,
-    };
-    let rows = bundler.plan(&id, now, ctx).await.unwrap();
-    let dailies: Vec<_> = rows
-        .iter()
-        .filter(|r| r.strategy == "daily")
-        .map(|r| (r.slot, r.status.clone()))
-        .collect();
-    let row = rows
-        .iter()
-        .find(|r| r.strategy == "daily" && r.slot == yesterday)
-        .unwrap_or_else(|| panic!("row for {yesterday}; dailies: {dailies:?}"));
-    assert!(
-        matches!(row.status, walgit_bundle::slots::SlotStatus::Skipped { .. }),
-        "{row:?}"
-    );
-    assert!(
-        bundler
-            .build_slot_unit(&id, "daily", yesterday)
-            .await
-            .unwrap()
-            .is_none()
-    );
-    assert_eq!(
-        ops::read_list(&tr.store)
-            .await
-            .unwrap()
-            .unwrap()
-            .skipped
-            .len(),
-        1
-    );
-
-    // A record for another base does not apply: same slot, different base → missing again.
-    let mut list = ops::read_list(&tr.store).await.unwrap().unwrap();
-    list.skipped[0].base_id = "weekly-older".into();
-    ops::cas_update_list(&tr.store, 4, |_| Ok(Some(list.clone())))
-        .await
-        .unwrap();
-    let rows = bundler.plan(&id, now, ctx).await.unwrap();
-    let row = rows
-        .iter()
-        .find(|r| r.strategy == "daily" && r.slot == yesterday)
-        .unwrap();
-    assert_eq!(
-        row.status,
-        walgit_bundle::slots::SlotStatus::Missing,
-        "{row:?}"
-    );
-}
-
-/// A strategy whose ref patterns match nothing (a repository without `main`
-/// under `bundles.main_only`) is `blocked` in the plan with the reason — never
-/// a silent `NoRefs` at debug level with the slot `missing` forever.
-#[tokio::test]
-async fn strategies_matching_no_refs_are_blocked_in_the_plan_with_the_reason() {
-    let tr = TestRepo::new("test", "nomain").await;
-    tr.commit("initial").await;
-    run_git(&tr.work_path, &["branch", "-M", "trunk"]).await; // no refs/heads/main
-    run_git(&tr.work_path, &["push", "origin", "trunk"]).await;
-    tr.local.refresh().unwrap();
-    tr.advance_seq();
-    let id = RepoId::new("test", "nomain").unwrap();
-    let mut source = TestSource::new();
-    source.add(&tr, id.clone());
-    let mut cfg = cfg_weekly_daily(4, 7);
-    cfg.bundles.main_only = true;
-    let bundler = Bundler::new_with_source(Arc::new(source), Arc::new(cfg));
-    let ctx = walgit_bundle::slots::PlanContext {
-        first_state: None,
-        can_full: true,
-        can_incremental: true,
-        wrong_host_reason: None,
-    };
-    let rows = bundler
-        .plan(&id, std::time::SystemTime::now(), ctx)
-        .await
-        .unwrap();
-    let weekly = rows
-        .iter()
-        .find(|r| r.strategy == "weekly")
-        .expect("weekly row");
-    match &weekly.status {
-        walgit_bundle::slots::SlotStatus::Blocked(why) => assert!(
-            why.contains("no refs match") && why.contains("main_only = true"),
-            "{why}"
-        ),
-        other => panic!("expected blocked, got {other:?}"),
-    }
-    assert!(
-        bundler
-            .run_due(&id, std::time::SystemTime::now())
-            .await
-            .unwrap()
-            .is_empty()
-    );
-}
diff --git a/crates/walgit-cli/Cargo.toml b/crates/walgit-cli/Cargo.toml
index 7748e73..f723126 100644
--- a/crates/walgit-cli/Cargo.toml
+++ b/crates/walgit-cli/Cargo.toml
@@ -24,7 +24,6 @@ walgit-config.workspace = true
 walgit-git.workspace = true
 walgit-wal.workspace = true
 walgit-server.workspace = true
-walgit-bundle = { path = "../walgit-bundle", features = ["wal"] }
 gix-hash.workspace = true
 anyhow.workspace = true
 tokio.workspace = true
diff --git a/crates/walgit-cli/src/bin/walgit.rs b/crates/walgit-cli/src/bin/walgit.rs
index b67e40a..e4acf99 100644
--- a/crates/walgit-cli/src/bin/walgit.rs
+++ b/crates/walgit-cli/src/bin/walgit.rs
@@ -1,4 +1,4 @@
-//! `walgit` — the full CLI (serve | compact | bundle | repo | wal | synth | import | mirror | config).
+//! `walgit` — the full CLI (serve | compact | repo | wal | synth | import | mirror | config).
 fn main() -> anyhow::Result<()> {
     walgit_cli::main()
 }
diff --git a/crates/walgit-cli/src/bundle_cmd.rs b/crates/walgit-cli/src/bundle_cmd.rs
deleted file mode 100644
index 6998cfa..0000000
--- a/crates/walgit-cli/src/bundle_cmd.rs
+++ /dev/null
@@ -1,525 +0,0 @@
-//! `walgit bundle run [--repo] [--strategy]` — build due bundles.
-//! `walgit bundle compose <repo> [--strategy]` — full bundle = header ∘ base pack (compose).
-
-use std::sync::Arc;
-
-use anyhow::{Result, bail};
-use tracing::info;
-
-use walgit_bundle::Bundler;
-use walgit_config::Config;
-use walgit_store::open_store;
-use walgit_wal::Registry;
-
-use crate::BundleAction;
-use crate::cli::parse_repo_id;
-
-pub async fn run(action: BundleAction, cfg: &Arc<Config>) -> Result<()> {
-    if !cfg.bundles.enabled {
-        bail!("bundles are disabled in config");
-    }
-
-    let store = open_store(cfg).await?;
-    let store_root = store.clone();
-    std::fs::create_dir_all(&cfg.cache.dir).ok();
-    let registry = Registry::new(store, cfg.clone());
-    let bundler = Bundler::new(registry.clone(), cfg.clone());
-
-    match action {
-        BundleAction::Run { repo, strategy } => {
-            if let Some(r) = repo {
-                let (owner, name) = parse_repo_id(&r)?;
-                let id = walgit_git::RepoId::new(owner, name)?;
-
-                if let Some(s) = strategy {
-                    let entry = bundler.build(&id, &s).await?;
-                    info!(repo = %id, strategy = %s, bundle = ?entry, "bundle built");
-                    println!("bundle built: {} strategy={} size={}", id, s, entry.size);
-                } else {
-                    let now = std::time::SystemTime::now();
-                    let entries = bundler.run_due(&id, now).await?;
-                    println!("built {} bundle(s) for {}", entries.len(), id);
-                    for e in &entries {
-                        println!("  strategy={} size={}", e.strategy, e.size);
-                    }
-                }
-            } else {
-                let now = std::time::SystemTime::now();
-                bundler.run_all_due(now).await?;
-                println!("bundle pass complete");
-            }
-        }
-        BundleAction::Plan { repo } => {
-            let (owner, name) = parse_repo_id(&repo)?;
-            let id = walgit_git::RepoId::new(owner, name)?;
-            let handle = registry.open(&id).await?;
-            drop(handle.sync_refs().await?);
-            // This process is not a maintainer: plan with "unknown host" capacity
-            // (can do everything) so the table shows built/missing/unavailable.
-            let ctx = walgit_bundle::slots::PlanContext {
-                first_state: handle.first_state_time(),
-                can_full: true,
-                can_incremental: true,
-                wrong_host_reason: None,
-            };
-            let rows = bundler.plan(&id, std::time::SystemTime::now(), ctx).await?;
-            {
-                let m = handle.manifest();
-                let fmt = |t: Option<std::time::SystemTime>| {
-                    t.map_or_else(
-                        || "-".into(),
-                        |t| humantime::format_rfc3339_seconds(t).to_string(),
-                    )
-                };
-                let cp = m.checkpoint.as_ref();
-                println!(
-                    "first state {}  (checkpoint seq {} created {} first_state_at {} as_of {}; head seq {})",
-                    fmt(handle.first_state_time()),
-                    cp.map_or(0, |c| c.seq),
-                    fmt(cp
-                        .and_then(|c| c.created_at.as_ref())
-                        .map(walgit_proto::time::to_system)),
-                    fmt(cp
-                        .and_then(|c| c.first_state_at.as_ref())
-                        .map(walgit_proto::time::to_system)),
-                    fmt(cp
-                        .and_then(|c| c.as_of.as_ref())
-                        .map(walgit_proto::time::to_system)),
-                    m.head_seq
-                );
-            }
-            println!(
-                "{:<8} {:<12} {:<20} status",
-                "strategy", "kind", "slot (UTC)"
-            );
-            for r in &rows {
-                let when = if r.slot == 0 {
-                    "-".to_string()
-                } else {
-                    chrono::DateTime::<chrono::Utc>::from(walgit_bundle::slots::from_epoch(r.slot))
-                        .format("%Y-%m-%d %H:%M")
-                        .to_string()
-                };
-                let status = match &r.status {
-                    walgit_bundle::slots::SlotStatus::Built { id, size, seq } => {
-                        format!("built {id} ({size} bytes, seq {seq})")
-                    }
-                    walgit_bundle::slots::SlotStatus::Missing => "MISSING".into(),
-                    walgit_bundle::slots::SlotStatus::Pending => {
-                        "pending (inside the close grace)".into()
-                    }
-                    walgit_bundle::slots::SlotStatus::Blocked(why) => format!("blocked: {why}"),
-                    walgit_bundle::slots::SlotStatus::Unavailable => {
-                        "unavailable (no WAL state at that time)".into()
-                    }
-                    walgit_bundle::slots::SlotStatus::TooSmall { commits, min } => format!(
-                        "too-small ({commits} commits since base, min {min}; next slot catches up)"
-                    ),
-                    walgit_bundle::slots::SlotStatus::Skipped { reason } => {
-                        format!("skipped ({reason}; recorded in the list)")
-                    }
-                    walgit_bundle::slots::SlotStatus::WrongHost(why) => {
-                        format!("wrong-host: {why}")
-                    }
-                };
-                println!(
-                    "{:<8} {:<12} {:<20} {}",
-                    r.strategy,
-                    format!("{:?}", r.kind).to_lowercase(),
-                    when,
-                    status
-                );
-            }
-            // Who maintains it, and what the next slot of each strategy will run.
-            let hbs = maintainers(&store_root).await?;
-            let up = walgit_server::maintain::upcoming(
-                &handle,
-                &handle.effective_config(),
-                &hbs,
-                std::time::SystemTime::now(),
-            )
-            .await;
-            if !up.is_empty() {
-                println!("\nnext:");
-                for u in &up {
-                    let when = chrono::DateTime::<chrono::Utc>::from(
-                        walgit_bundle::slots::from_epoch(u.slot),
-                    )
-                    .format("%Y-%m-%d %H:%M")
-                    .to_string();
-                    println!(
-                        "  {:<8} {:<17} → {}{}",
-                        u.strategy,
-                        when,
-                        u.unit,
-                        u.host.as_deref().map_or_else(
-                            || "  [no live maintainer]".into(),
-                            |h| if u.unit.contains(h) {
-                                String::new()
-                            } else {
-                                format!("  [{h}]")
-                            }
-                        )
-                    );
-                }
-            }
-            let mine: Vec<_> = hbs
-                .iter()
-                .filter(|h| {
-                    walgit_config::repo_listed(&h.repos, id.owner(), id.name())
-                        && !walgit_config::repo_listed(&h.exclude, id.owner(), id.name())
-                })
-                .collect();
-            if mine.is_empty() {
-                println!(
-                    "\nmaintainers: NOBODY maintains {id} (no heartbeat with a matching assignment)"
-                );
-            } else {
-                println!("\nmaintainers:");
-                for h in mine {
-                    let last = h.last_pass_at.as_ref().map(walgit_proto::time::to_system);
-                    let age = last
-                        .and_then(|t| std::time::SystemTime::now().duration_since(t).ok())
-                        .map_or(u64::MAX, |d| d.as_secs());
-                    println!(
-                        "  {} ({}, {} cap) — last pass {}s ago ({}), {} passes, last unit: {}",
-                        h.host,
-                        h.disk,
-                        h.max_pack_bytes,
-                        if age == u64::MAX {
-                            "?".into()
-                        } else {
-                            age.to_string()
-                        },
-                        if age < 600 { "alive" } else { "STALE" },
-                        h.passes,
-                        if h.last_unit.is_empty() {
-                            "-"
-                        } else {
-                            &h.last_unit
-                        }
-                    );
-                }
-            }
-        }
-        BundleAction::Rm { repo, ids } => {
-            let (owner, name) = parse_repo_id(&repo)?;
-            let id = walgit_git::RepoId::new(owner, name)?;
-            let handle = registry.open(&id).await?;
-            let store = handle.store().clone();
-            let wanted: std::collections::HashSet<&str> = ids.iter().map(String::as_str).collect();
-            let mut removed: Vec<walgit_proto::v1::BundleEntry> = Vec::new();
-            let res = walgit_bundle::ops::cas_update_list(&store, 8, |cur| {
-                let Some(cur) = cur else { return Ok(None) };
-                let mut next = cur.clone();
-                removed = cur
-                    .bundles
-                    .iter()
-                    .filter(|b| wanted.contains(b.id.as_str()))
-                    .cloned()
-                    .collect();
-                if removed.is_empty() {
-                    return Ok(None);
-                }
-                next.bundles.retain(|b| !wanted.contains(b.id.as_str()));
-                next.updated_at = Some(walgit_proto::time::now());
-                Ok(Some(next))
-            })
-            .await?;
-            anyhow::ensure!(res.is_some(), "none of {ids:?} is in the list");
-            for b in &removed {
-                match walgit_store::ObjectStore::delete(&store, &b.key, None).await {
-                    Ok(()) => println!(
-                        "removed {} ({} bytes, token {}, slot {}) and deleted {}",
-                        b.id, b.size, b.creation_token, b.slot, b.key
-                    ),
-                    Err(e) => println!(
-                        "removed {} from the list; deleting {} failed: {e}",
-                        b.id, b.key
-                    ),
-                }
-            }
-            let missing: Vec<&str> = ids
-                .iter()
-                .map(String::as_str)
-                .filter(|i| !removed.iter().any(|b| b.id == *i))
-                .collect();
-            if !missing.is_empty() {
-                println!("not in the list: {}", missing.join(", "));
-            }
-        }
-        BundleAction::Compose { repo, strategy } => {
-            let (owner, name) = parse_repo_id(&repo)?;
-            let id = walgit_git::RepoId::new(owner, name)?;
-            let strategy = match strategy {
-                Some(s) => s,
-                None => cfg
-                    .bundles
-                    .strategy
-                    .iter()
-                    .find(|s| s.kind == walgit_config::BundleKind::Full)
-                    .map(|s| s.name.clone())
-                    .ok_or_else(|| anyhow::anyhow!("no full bundle strategy configured"))?,
-            };
-            let entry = compose_full_from_base(&registry, &id, &strategy, cfg).await?;
-            println!(
-                "composed full bundle {} for {id}: {} bytes at seq {}, creationToken {}, {} tips",
-                entry.key,
-                entry.size,
-                entry.seq,
-                entry.creation_token,
-                entry.tips.len()
-            );
-        }
-    }
-    Ok(())
-}
-
-/// Every maintainer heartbeat in the bucket (`maintain/<host>.pb`).
-pub async fn maintainers(
-    store: &walgit_store::DynStore,
-) -> Result<Vec<walgit_proto::v1::MaintainerHeartbeat>> {
-    use futures::StreamExt;
-    use walgit_proto::prost::Message;
-    use walgit_store::ObjectStoreExt;
-    let mut out = Vec::new();
-    let mut keys = store.list(walgit_proto::keys::MAINTAIN_DIR, None);
-    while let Some(m) = keys.next().await {
-        let m = m?;
-        if let Some((_, bytes)) = store.get_bytes(&m.key).await?
-            && let Ok(hb) = walgit_proto::v1::MaintainerHeartbeat::decode(bytes.as_ref())
-        {
-            out.push(hb);
-        }
-    }
-    Ok(out)
-}
-
-/// Moved to `walgit_server::bundles::compose_full_from_base` (the maintainer's
-/// weekly unit uses it too); the CLI delegates.
-pub async fn compose_full_from_base(
-    registry: &Registry,
-    id: &walgit_git::RepoId,
-    strategy: &str,
-    cfg: &Config,
-) -> Result<walgit_proto::v1::BundleEntry> {
-    let now = std::time::SystemTime::now();
-    let slot = cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == strategy)
-        .and_then(|s| {
-            walgit_bundle::slots::last_slot_at_or_before(s, now)
-                .ok()
-                .flatten()
-        })
-        .unwrap_or(0);
-    walgit_server::bundles::compose_full_from_base(registry, id, strategy, cfg, slot).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-    use walgit_store::ObjectStoreExt;
-
-    fn run_git(dir: &std::path::Path, args: &[&str]) -> String {
-        let out = std::process::Command::new("git")
-            .current_dir(dir)
-            .args(args)
-            .output()
-            .unwrap();
-        assert!(
-            out.status.success(),
-            "git {args:?}: {}",
-            String::from_utf8_lossy(&out.stderr)
-        );
-        String::from_utf8_lossy(&out.stdout).trim().to_string()
-    }
-
-    /// Full bundle composed from the base pack with the refs at the base's
-    /// seq: a later push does not leak into the header; the object is a valid
-    /// bundle (`git bundle verify`) listing the base tip.
-    #[tokio::test]
-    async fn compose_full_uses_refs_at_base_seq() {
-        let cache = tempfile::tempdir().unwrap();
-        let store = walgit_store::memory::MemoryStore::shared();
-        let mut cfg = Config::default();
-        cfg.cache.dir = cache.path().to_path_buf();
-        cfg.store.bucket = "test".into();
-        cfg.wal.fsck_objects = false;
-        cfg.wal.check_connectivity = false;
-        cfg.wal.freshness_ttl = std::time::Duration::ZERO;
-        cfg.wal.snapshot_every_entries = 0;
-        cfg.wal.checkpoint_interval = std::time::Duration::ZERO;
-        cfg.wal.checkpoint_tail_bytes = walgit_config::ByteSize::b(0);
-        let cfg = Arc::new(cfg);
-        let registry = Registry::new(store.clone(), cfg.clone());
-        let id = walgit_git::RepoId::new("t", "compose").unwrap();
-        let handle = registry
-            .create(&id, walgit_git::ObjectFormat::Sha1)
-            .await
-            .unwrap();
-
-        let work = tempfile::tempdir().unwrap();
-        run_git(work.path(), &["init", "-q", "-b", "main"]);
-        run_git(work.path(), &["config", "user.email", "t@t"]);
-        run_git(work.path(), &["config", "user.name", "t"]);
-        let mut prev = String::new();
-        for i in 0..3 {
-            std::fs::write(work.path().join(format!("f{i}")), format!("{i}\n")).unwrap();
-            run_git(work.path(), &["add", "."]);
-            run_git(work.path(), &["commit", "-q", "-m", &format!("c{i}")]);
-            let c = run_git(work.path(), &["rev-parse", "HEAD"]);
-            let out = std::process::Command::new("sh")
-                .arg("-c")
-                .arg(format!(
-                    "git rev-list --objects {c} {} | git pack-objects --stdout",
-                    if prev.is_empty() {
-                        String::new()
-                    } else {
-                        format!("^{prev}")
-                    }
-                ))
-                .current_dir(work.path())
-                .output()
-                .unwrap();
-            let ingested = handle
-                .local()
-                .ingest_pack(
-                    std::io::Cursor::new(out.stdout),
-                    walgit_git::IngestOptions {
-                        fsck: false,
-                        max_bytes: None,
-                        thin: false,
-                    },
-                )
-                .await
-                .unwrap()
-                .unwrap();
-            handle
-                .publish_push(
-                    Some(ingested),
-                    walgit_proto::v1::RefTransaction {
-                        updates: vec![walgit_proto::v1::RefUpdate {
-                            name: "refs/heads/main".into(),
-                            old_oid: prev.clone(),
-                            new_oid: c.clone(),
-                            new_symbolic_target: String::new(),
-                            new_peeled: String::new(),
-                        }],
-                        push_options: vec![],
-                        atomic: true,
-                    },
-                    HashMap::new(),
-                )
-                .await
-                .unwrap();
-            prev = c;
-        }
-        let base_tip = prev.clone();
-        let repack = handle
-            .local()
-            .repack(walgit_git::RepackOptions {
-                mode: walgit_git::RepackMode::Full,
-                write_bitmap: true,
-                write_midx: false,
-                keep: vec![],
-            })
-            .await
-            .unwrap();
-        let base = repack.new_packs[0].clone();
-        let base_seq = handle
-            .publish_compact(base.clone(), repack.removed.clone(), 2)
-            .await
-            .unwrap();
-        // Checkpoint at the base seq (what the VM job does right after compact --base).
-        let cp = handle.write_checkpoint().await.unwrap();
-        assert_eq!(cp.seq, base_seq);
-        // A later push moves main past the base.
-        std::fs::write(work.path().join("later"), "later\n").unwrap();
-        run_git(work.path(), &["add", "."]);
-        run_git(work.path(), &["commit", "-q", "-m", "later"]);
-        let later = run_git(work.path(), &["rev-parse", "HEAD"]);
-        let out = std::process::Command::new("sh")
-            .arg("-c")
-            .arg(format!(
-                "git rev-list --objects {later} ^{base_tip} | git pack-objects --stdout"
-            ))
-            .current_dir(work.path())
-            .output()
-            .unwrap();
-        let ingested = handle
-            .local()
-            .ingest_pack(
-                std::io::Cursor::new(out.stdout),
-                walgit_git::IngestOptions {
-                    fsck: false,
-                    max_bytes: None,
-                    thin: false,
-                },
-            )
-            .await
-            .unwrap()
-            .unwrap();
-        handle
-            .publish_push(
-                Some(ingested),
-                walgit_proto::v1::RefTransaction {
-                    updates: vec![walgit_proto::v1::RefUpdate {
-                        name: "refs/heads/main".into(),
-                        old_oid: base_tip.clone(),
-                        new_oid: later.clone(),
-                        new_symbolic_target: String::new(),
-                        new_peeled: String::new(),
-                    }],
-                    push_options: vec![],
-                    atomic: true,
-                },
-                HashMap::new(),
-            )
-            .await
-            .unwrap();
-
-        let entry = compose_full_from_base(&registry, &id, "weekly", &cfg)
-            .await
-            .unwrap();
-        assert_eq!(entry.kind, "full");
-        assert_eq!(entry.seq, base_seq);
-        assert!(
-            entry
-                .tips
-                .iter()
-                .any(|t| t.name == "refs/heads/main" && t.oid == base_tip),
-            "{:?}",
-            entry.tips
-        );
-        assert!(
-            !entry.tips.iter().any(|t| t.oid == later),
-            "later push must not be in the header"
-        );
-        let list = walgit_bundle::ops::read_list(handle.store())
-            .await
-            .unwrap()
-            .unwrap();
-        assert!(list.bundles.iter().any(|b| b.key == entry.key));
-        // The composed object is a valid bundle.
-        let (_, bytes) = handle.store().get_bytes(&entry.key).await.unwrap().unwrap();
-        let f = cache.path().join("full.bundle");
-        std::fs::write(&f, &bytes).unwrap();
-        let clone = tempfile::tempdir().unwrap();
-        run_git(clone.path(), &["init", "-q", "--bare"]);
-        let v = std::process::Command::new("git")
-            .current_dir(clone.path())
-            .args(["bundle", "verify", f.to_str().unwrap()])
-            .output()
-            .unwrap();
-        assert!(v.status.success(), "{}", String::from_utf8_lossy(&v.stderr));
-        let heads = run_git(clone.path(), &["bundle", "list-heads", f.to_str().unwrap()]);
-        assert!(
-            heads.contains(&base_tip) && !heads.contains(&later),
-            "{heads}"
-        );
-    }
-}
diff --git a/crates/walgit-cli/src/compact.rs b/crates/walgit-cli/src/compact.rs
index a53c1a8..be7cc2c 100644
--- a/crates/walgit-cli/src/compact.rs
+++ b/crates/walgit-cli/src/compact.rs
@@ -21,8 +21,8 @@ pub async fn run(
     base: bool,
     cfg: &Arc<Config>,
 ) -> Result<()> {
-    if !cfg.compaction.enabled {
-        bail!("compaction is disabled in config");
+    if !cfg.packs.enabled {
+        bail!("pack maintenance is disabled in config");
     }
 
     let store = open_store(cfg).await?;
@@ -43,7 +43,7 @@ pub async fn run(
     }
     loop {
         for id in &target_repos {
-            match compact_one(&registry, id, cfg, base).await {
+            match compact_one(&registry, id, base).await {
                 Ok(summary) => println!("{id}: {summary}"),
                 Err(e) => warn!(repo = %id, error = %e, "compaction failed"),
             }
@@ -56,12 +56,7 @@ pub async fn run(
     Ok(())
 }
 
-async fn compact_one(
-    registry: &Registry,
-    id: &walgit_git::RepoId,
-    cfg: &Config,
-    base: bool,
-) -> Result<String> {
+async fn compact_one(registry: &Registry, id: &walgit_git::RepoId, base: bool) -> Result<String> {
     let handle = registry.open(id).await?;
     let log = |line: String| {
         info!(repo = %id, "{line}");
@@ -69,7 +64,6 @@ async fn compact_one(
     };
     let outcome = compact_repo(
         &handle,
-        cfg,
         CompactRequest {
             force: base,
             rebuild_base: base,
@@ -79,8 +73,7 @@ async fn compact_one(
     .await?;
     let mut summary = outcome.summary();
     if base {
-        // The weekly bundle is composed from this base with the refs at its
-        // seq: write the checkpoint now so `walgit bundle compose` finds them.
+        // Checkpoint the rebuilt pack set so cold readers can install it directly.
         let cp = handle.write_checkpoint().await?;
         {
             let _ = std::fmt::Write::write_fmt(
diff --git a/crates/walgit-cli/src/import_direct.rs b/crates/walgit-cli/src/import_direct.rs
index 845a25c..1ed400e 100644
--- a/crates/walgit-cli/src/import_direct.rs
+++ b/crates/walgit-cli/src/import_direct.rs
@@ -11,15 +11,11 @@
 //! parallel part uploads + server-side compose, writes a checkpoint (ref
 //! snapshot + pack set) and CAS-publishes the manifest. Replicas then
 //! materialize by downloading the pack set and loading the ref snapshot.
-//!
-//! With `--bundle` it also publishes a bundle-uri full bundle *without
-//! re-uploading the pack*: bundle = header object ∘ pack object via compose
-//! (GCS), so a fresh `git clone` gets its bytes straight from the bucket/CDN.
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
 use std::sync::Arc;
-use std::time::{Instant, SystemTime};
+use std::time::Instant;
 
 use anyhow::{Context, Result, bail};
 use tracing::info;
@@ -27,9 +23,7 @@ use walgit_proto::prost::Message;
 
 use walgit_config::Config;
 use walgit_proto::keys;
-use walgit_proto::v1::{
-    BundleEntry, BundleList, Checkpoint, CheckpointRef, Manifest, PackRef, Ref, RefSnapshot,
-};
+use walgit_proto::v1::{Checkpoint, CheckpointRef, Manifest, PackRef, Ref, RefSnapshot};
 use walgit_proto::{WAL_FORMAT_VERSION, time};
 use walgit_store::{
     ObjectStore, ObjectStoreExt, Prefixed, PutBody, PutMode, PutOptions, StoreError, open_store,
@@ -43,10 +37,6 @@ pub struct DirectOptions {
     /// Directory holding the pack set to publish (pack-*.pack + .idx [+ .rev, .bitmap]).
     /// Defaults to the source repo's objects/pack.
     pub packs: Option<PathBuf>,
-    /// Also publish a full bundle for bundle-uri (header ∘ pack).
-    pub bundle: bool,
-    /// Bundle strategy name (defaults to the first `kind = "full"` strategy, else "import").
-    pub bundle_strategy: Option<String>,
     /// Replace an existing non-empty repository (new checkpoint supersedes everything).
     pub replace: bool,
     /// Concurrent part uploads.
@@ -117,7 +107,7 @@ pub struct ImportReport {
 }
 
 /// Phases of a direct import, in order; the marker names the last one completed. Uploads are
-/// tracked per object (`ImportMarker::uploaded`), the bundle by its entry.
+/// tracked per object (`ImportMarker::uploaded`).
 #[derive(
     Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
 )]
@@ -128,7 +118,7 @@ pub enum ImportPhase {
     SideFiles,
     HistoryPack,
     Uploaded,
-    Bundled,
+    CheckpointPrepared,
 }
 
 /// `walgit-import/<owner>-<repo>.json` next to the pack dir: what an interrupted import had
@@ -151,23 +141,6 @@ pub struct ImportMarker {
     /// `pack-<hash>.pack` path of the history pack built from the source (reused on resume).
     #[serde(default)]
     pub history_pack: Option<PathBuf>,
-    /// The composed full bundle, once published (its list entry is added after the manifest
-    /// CAS): the protobuf `BundleEntry`, hex-encoded.
-    #[serde(default)]
-    pub bundle: Option<String>,
-}
-
-fn entry_to_hex(e: &BundleEntry) -> String {
-    e.encode_to_vec()
-        .iter()
-        .map(|b| format!("{b:02x}"))
-        .collect()
-}
-fn entry_from_hex(s: &str) -> Option<BundleEntry> {
-    let bytes: Option<Vec<u8>> = (0..s.len() / 2)
-        .map(|i| u8::from_str_radix(&s[2 * i..2 * i + 2], 16).ok())
-        .collect();
-    BundleEntry::decode(bytes?.as_slice()).ok()
 }
 
 fn tips_hash(snap: &RefSnapshot) -> String {
@@ -200,7 +173,8 @@ fn write_import_marker(path: &Path, m: &ImportMarker) -> Result<()> {
 }
 
 /// Test hook: abort the import of `repo` right after `phase`'s marker was written (a SIGTERM /
-/// lost network between phases). `Uploaded` aborts after the first object of the upload phase.
+/// lost network between phases). `Uploaded` aborts after the first object of the upload phase;
+/// `CheckpointPrepared` stops after immutable candidates and before the manifest CAS.
 pub static TEST_ABORT_AFTER: parking_lot::Mutex<
     Option<std::collections::HashMap<String, ImportPhase>>,
 > = parking_lot::Mutex::new(None);
@@ -272,7 +246,7 @@ pub fn decide_resume(
 
 pub async fn run(opts: DirectOptions, cfg: &Arc<Config>, force: bool) -> Result<()> {
     let store = open_store(cfg).await?;
-    let report = run_with_store(opts, cfg, store, force).await?;
+    let report = run_with_store(opts, store, force).await?;
     println!(
         "import: seq {}, {} object(s) uploaded, {} skipped, {} manifest write(s){}{}",
         report.seq,
@@ -289,7 +263,6 @@ pub async fn run(opts: DirectOptions, cfg: &Arc<Config>, force: bool) -> Result<
 /// [`ResumeDecision`]. Re-running a completed import is a no-op; an interrupted one resumes.
 pub async fn run_with_store(
     opts: DirectOptions,
-    cfg: &Arc<Config>,
     store: walgit_store::DynStore,
     force: bool,
 ) -> Result<ImportReport> {
@@ -365,6 +338,11 @@ pub async fn run_with_store(
     let (base_manifest, base_version) = match existing {
         Some((meta, bytes)) => {
             let m = Manifest::decode(bytes.as_ref()).context("decoding existing manifest")?;
+            walgit_wal::validate_manifest(&m).context("validating existing manifest")?;
+            anyhow::ensure!(
+                m.repo == id.to_string(),
+                "manifest repository identity disagrees with target"
+            );
             if m.object_format != format.as_str() {
                 bail!(
                     "object format mismatch: repo is {}, source is {}",
@@ -447,7 +425,6 @@ pub async fn run_with_store(
                 phase: ImportPhase::Started,
                 uploaded: Vec::new(),
                 history_pack: None,
-                bundle: None,
             };
             write_import_marker(&marker_path, &m)?;
             m
@@ -710,6 +687,8 @@ pub async fn run_with_store(
                 walgit_proto::v1::PackKind::Objects as i32
             },
             derived_from: p.history_of.clone().unwrap_or_default(),
+            published_at: Some(time::now()),
+            ..Default::default()
         });
     }
     if marker.phase < ImportPhase::Uploaded {
@@ -724,124 +703,90 @@ pub async fn run_with_store(
         up_started.elapsed().as_secs_f64()
     );
 
-    // ---- checkpoint refs (small, idempotent re-put) -----------------------------------------
-    let refs_key = keys::checkpoint_refs_key(seq);
-    let mut snap = snap;
-    snap.seq = seq;
-    snap.object_format = format.as_str().to_string();
-    snap.created_at = Some(time::now());
-    repo_store
-        .put(
-            &refs_key,
-            PutBody::Bytes(snap.encode_to_vec().into()),
-            PutOptions {
-                immutable: true,
-                ..Default::default()
-            },
-        )
-        .await?;
-
-    // ---- bundle (header ∘ pack), once --------------------------------------------------------
-    let mut bundle_key = String::new();
-    let mut bundle_entry: Option<BundleEntry> = marker.bundle.as_deref().and_then(entry_from_hex);
-    if opts.bundle && bundle_entry.is_none() {
-        if object_packs == 1 {
-            let strategy = opts.bundle_strategy.clone().unwrap_or_else(|| {
-                cfg.bundles
-                    .strategy
-                    .iter()
-                    .find(|s| s.kind == walgit_config::BundleKind::Full)
-                    .map_or_else(|| "import".to_string(), |s| s.name.clone())
-            });
-            let p0 = &packs[0];
-            match walgit_bundle::ops::compose_full(
-                &repo_store,
-                &p0.checksum,
-                p0.pack_size,
-                Some(p0.pack.as_path()),
-                &snap,
-                format,
-                &strategy,
-                seq,
-                0,
-                SystemTime::now(),
-                0,
-                None,
-            )
-            .await
-            {
-                Ok(entry) => {
-                    println!(
-                        "bundle: {} ({} bytes, {} tips)",
-                        entry.key,
-                        entry.size,
-                        entry.tips.len()
-                    );
-                    marker.bundle = Some(entry_to_hex(&entry));
-                    bundle_entry = Some(entry);
-                }
-                Err(e) => eprintln!("bundle publish failed (import continues): {e:#}"),
+    // Preserve classifications and provenance of identical immutable packs already committed.
+    // Fresh imports have no group proof until maintenance classifies their actual object sets.
+    if let Some(base) = &base_manifest {
+        for pack in &mut pack_refs {
+            if let Some(previous) = base.packs.iter().find(|p| p.checksum == pack.checksum) {
+                anyhow::ensure!(
+                    previous.pack_size == pack.pack_size && previous.idx_size == pack.idx_size,
+                    "committed pack {} disagrees with import sizes",
+                    pack.checksum
+                );
+                let mut retained = previous.clone();
+                retained.has_rev |= pack.has_rev;
+                retained.has_bitmap |= pack.has_bitmap;
+                retained.has_commit_graph |= pack.has_commit_graph;
+                *pack = retained;
             }
-        } else {
-            eprintln!(
-                "--bundle needs exactly one object pack (got {object_packs}); skipping bundle"
-            );
         }
     }
-    if let Some(e) = &bundle_entry {
-        bundle_key = e.key.clone();
-    }
-    if marker.phase < ImportPhase::Bundled {
-        marker.phase = ImportPhase::Bundled;
-        write_import_marker(&marker_path, &marker)?;
-        abort_after(&repo_key, ImportPhase::Bundled)?;
-    }
 
+    // Both immutable candidates are named exactly by the manifest CAS. A concurrent
+    // import may prepare different refs at the same sequence without overwriting these bytes.
+    snap.seq = seq;
+    snap.object_format = format.as_str().to_string();
+    let snap_bytes = walgit_proto::snapshot::encode(&snap)?;
+    let refs_key = walgit_proto::snapshot::key(&snap_bytes);
+    let created_at = time::now();
+    let writer = format!("walgit-import@{}", hostname());
     let checkpoint = Checkpoint {
         seq,
         object_format: format.as_str().to_string(),
         packs: pack_refs.clone(),
         refs_key: refs_key.clone(),
         ref_count: snap.refs.len() as u64,
-        bundle_key,
-        created_at: Some(time::now()),
-        writer: format!("walgit-import@{}", hostname()),
+        bundle_key: String::new(),
+        created_at: Some(created_at),
+        writer: writer.clone(),
     };
-    let cp_key = keys::checkpoint_key(seq);
-    repo_store
-        .put(
-            &cp_key,
-            PutBody::Bytes(checkpoint.encode_to_vec().into()),
-            PutOptions {
-                immutable: true,
-                ..Default::default()
-            },
-        )
-        .await?;
+    let cp_key = keys::checkpoint_attempt_key(seq, &format!("{:032x}", rand::random::<u128>()));
+    let (refs_result, checkpoint_result) = tokio::join!(
+        put_snapshot_candidate(&repo_store, &refs_key, snap_bytes),
+        put_snapshot_candidate(&repo_store, &cp_key, checkpoint.encode_to_vec()),
+    );
+    refs_result?;
+    checkpoint_result?;
+    marker.phase = ImportPhase::CheckpointPrepared;
+    write_import_marker(&marker_path, &marker)?;
+    abort_after(&repo_key, ImportPhase::CheckpointPrepared)?;
 
-    // ---- manifest CAS (the linearization point) --------------------------------------
-    let manifest = Manifest {
+    // Replace repository content on the captured CAS basis, preserving unrelated durable state.
+    // A conflict refuses the import; --force starts a new attempt against the changed manifest.
+    let mut manifest = base_manifest.clone().unwrap_or_else(|| Manifest {
         format_version: WAL_FORMAT_VERSION,
         repo: id.to_string(),
         object_format: format.as_str().to_string(),
-        head_seq: seq,
-        min_seq: seq + 1,
-        // An import's first state is the import itself (history before it is
-        // not in the WAL): first_state_at = as_of = now.
-        checkpoint: Some(CheckpointRef {
-            seq,
-            key: cp_key,
-            created_at: Some(walgit_proto::time::now()),
-            first_state_at: Some(walgit_proto::time::now()),
-            as_of: Some(walgit_proto::time::now()),
-        }),
-        log_segments: vec![],
-        packs: pack_refs,
-        updated_at: Some(time::now()),
-        writer: format!("walgit-import@{}", hostname()),
-        revision: base_manifest.as_ref().map_or(0, |m| m.revision) + 1,
-        settings: None,
-    };
+        ..Default::default()
+    });
+    let removed: Vec<_> = manifest
+        .packs
+        .iter()
+        .filter(|old| !pack_refs.iter().any(|new| new.checksum == old.checksum))
+        .map(|old| old.checksum.clone())
+        .collect();
+    manifest.retire_packs(&removed, seq);
+    let first_state_at = manifest
+        .checkpoint
+        .as_ref()
+        .and_then(|cp| cp.first_state_at)
+        .or(Some(created_at));
+    manifest.head_seq = seq;
+    manifest.min_seq = seq + 1;
+    manifest.checkpoint = Some(CheckpointRef {
+        seq,
+        key: cp_key,
+        refs_key,
+        created_at: Some(created_at),
+        first_state_at,
+        as_of: Some(created_at),
+    });
+    manifest.log_segments.clear();
+    manifest.packs = pack_refs;
+    manifest.updated_at = Some(created_at);
+    manifest.writer = writer;
+    manifest.revision += 1;
+    walgit_wal::validate_manifest(&manifest).context("validating import manifest")?;
     let mode = match base_version {
         Some(v) => PutMode::Update(v),
         None => PutMode::Create,
@@ -869,35 +814,6 @@ pub async fn run_with_store(
         Err(e) => return Err(e.into()),
     }
 
-    // ---- bundle list (after the manifest: nothing advertises objects before they exist)
-    if let Some(entry) = bundle_entry {
-        let keep_strategy = entry.strategy.clone();
-        let (_, list) = cas_update_bundle_list(&repo_store, |cur| {
-            let mut list = cur.cloned().unwrap_or(BundleList {
-                mode: "all".into(),
-                heuristic: "creationToken".into(),
-                bundles: vec![],
-                updated_at: None,
-                skipped: vec![],
-            });
-            // A new full import supersedes older bundles of the same strategy and
-            // every incremental built on them.
-            let old_ids: Vec<String> = list
-                .bundles
-                .iter()
-                .filter(|b| b.strategy == keep_strategy)
-                .map(|b| b.id.clone())
-                .collect();
-            list.bundles
-                .retain(|b| b.strategy != keep_strategy && !old_ids.contains(&b.base_id));
-            list.bundles.push(entry.clone());
-            list.updated_at = Some(time::now());
-            list
-        })
-        .await?;
-        println!("bundle list: {} bundle(s)", list.bundles.len());
-    }
-
     // Done: the marker goes (a re-run is answered by the manifest itself).
     let _ = std::fs::remove_file(&marker_path);
     println!("done in {:.1}s", started.elapsed().as_secs_f64());
@@ -906,6 +822,37 @@ pub async fn run_with_store(
 
 // ---- helpers -------------------------------------------------------------------
 
+/// Immutable small candidates are never overwritten. A precondition failure is safe
+/// only when the existing bytes match; all verification reads stay on that failure path.
+async fn put_snapshot_candidate(store: &Prefixed, key: &str, bytes: Vec<u8>) -> Result<()> {
+    match store
+        .put(
+            key,
+            PutBody::Bytes(bytes.clone().into()),
+            PutOptions {
+                mode: PutMode::Create,
+                immutable: true,
+                ..Default::default()
+            },
+        )
+        .await
+    {
+        Ok(_) => Ok(()),
+        Err(StoreError::PreconditionFailed { .. }) => {
+            let (_, existing) = store
+                .get_bytes(key)
+                .await?
+                .with_context(|| format!("candidate {key} disappeared after Create conflict"))?;
+            anyhow::ensure!(
+                existing.as_ref() == bytes.as_slice(),
+                "immutable candidate {key} has conflicting bytes"
+            );
+            Ok(())
+        }
+        Err(error) => Err(error.into()),
+    }
+}
+
 fn hostname() -> String {
     std::fs::read_to_string("/etc/hostname")
         .map_or_else(|_| "local".into(), |s| s.trim().to_string())
@@ -1175,40 +1122,6 @@ fn idx_object_count(idx: &Path) -> Result<u64> {
     Ok(u64::from(u32::from_be_bytes(b)))
 }
 
-/// Git bundle header for `snap` (HEAD + refs/heads/* + refs/tags/*), no prerequisites.
-async fn cas_update_bundle_list<F>(
-    store: &Prefixed,
-    mut f: F,
-) -> Result<(walgit_store::Version, BundleList)>
-where
-    F: FnMut(Option<&BundleList>) -> BundleList,
-{
-    for _ in 0..16 {
-        let cur = store.get_bytes(keys::BUNDLE_LIST).await?;
-        let (mode, cur_list) = match &cur {
-            None => (PutMode::Create, None),
-            Some((meta, bytes)) => (
-                PutMode::Update(meta.version.clone()),
-                Some(BundleList::decode(bytes.as_ref())?),
-            ),
-        };
-        let new_list = f(cur_list.as_ref());
-        match store
-            .put(
-                keys::BUNDLE_LIST,
-                PutBody::Bytes(new_list.encode_to_vec().into()),
-                PutOptions::from(mode),
-            )
-            .await
-        {
-            Ok(meta) => return Ok((meta.version, new_list)),
-            Err(StoreError::PreconditionFailed { .. }) => continue,
-            Err(e) => return Err(e.into()),
-        }
-    }
-    bail!("bundle list CAS retries exhausted")
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1375,8 +1288,6 @@ mod resume_tests {
             from: src.to_path_buf(),
             repo: repo.into(),
             packs: None,
-            bundle: true,
-            bundle_strategy: Some("weekly".into()),
             replace: false,
             parallelism: 2,
             commit_graph: true,
@@ -1386,12 +1297,6 @@ mod resume_tests {
         }
     }
 
-    fn cfg() -> Arc<Config> {
-        let mut c = Config::default();
-        c.store.backend = walgit_config::StoreBackend::Memory;
-        Arc::new(c)
-    }
-
     #[test]
     fn resume_decision_matches_intent_and_base() {
         let m = ImportMarker {
@@ -1403,7 +1308,6 @@ mod resume_tests {
             phase: ImportPhase::Uploaded,
             uploaded: vec![],
             history_pack: None,
-            bundle: None,
         };
         assert_eq!(
             decide_resume(None, "o/r", "t1", Some("v1"), false),
@@ -1447,7 +1351,6 @@ mod resume_tests {
         assert!(
             ImportPhase::Started < ImportPhase::Verified
                 && ImportPhase::Verified < ImportPhase::Uploaded
-                && ImportPhase::Uploaded < ImportPhase::Bundled
         );
     }
 
@@ -1457,7 +1360,6 @@ mod resume_tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn interrupted_import_resumes_and_a_completed_one_is_a_noop() {
         let src = source();
-        let cfg = cfg();
         let store = walgit_store::memory::MemoryStore::shared();
         let repo = "t/resume";
         let id = walgit_git::RepoId::new("t", "resume").unwrap();
@@ -1474,10 +1376,10 @@ mod resume_tests {
             ImportPhase::SideFiles,
             ImportPhase::HistoryPack,
             ImportPhase::Uploaded,
-            ImportPhase::Bundled,
+            ImportPhase::CheckpointPrepared,
         ] {
             set_abort(repo, Some(phase));
-            let r = run_with_store(opts(src.path(), repo), &cfg, store.clone(), false).await;
+            let r = run_with_store(opts(src.path(), repo), store.clone(), false).await;
             assert!(r.is_err(), "killed after {phase:?} must fail: {r:?}");
             let marker = read_import_marker(&marker_path).expect("marker survives the kill");
             if phase == ImportPhase::Uploaded {
@@ -1506,7 +1408,7 @@ mod resume_tests {
         }
         set_abort(repo, None);
         // The resumed run finishes without redoing any local phase or upload.
-        let r = run_with_store(opts(src.path(), repo), &cfg, store.clone(), false)
+        let r = run_with_store(opts(src.path(), repo), store.clone(), false)
             .await
             .unwrap();
         assert!(r.resumed && !r.noop && r.cas == 1, "{r:?}");
@@ -1551,21 +1453,16 @@ mod resume_tests {
         assert_eq!(m.head_seq, 1);
         assert!(!marker_path.exists(), "marker removed after success");
         let cas = r.cas;
-        // Bundle list has exactly one weekly.
-        let list = BundleList::decode(
+        assert!(
             repo_store
                 .get_bytes(keys::BUNDLE_LIST)
                 .await
                 .unwrap()
-                .unwrap()
-                .1
-                .as_ref(),
-        )
-        .unwrap();
-        assert_eq!(list.bundles.len(), 1, "{list:?}");
+                .is_none()
+        );
 
         // Completed import, same command again: no-op.
-        let r2 = run_with_store(opts(src.path(), repo), &cfg, store.clone(), false)
+        let r2 = run_with_store(opts(src.path(), repo), store.clone(), false)
             .await
             .unwrap();
         assert!(r2.noop, "{r2:?}");
@@ -1592,12 +1489,11 @@ mod resume_tests {
     #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
     async fn resume_refuses_a_moved_target_unless_forced() {
         let src = source();
-        let cfg = cfg();
         let store = walgit_store::memory::MemoryStore::shared();
         let repo = "t/moved";
         set_abort(repo, Some(ImportPhase::Uploaded));
         assert!(
-            run_with_store(opts(src.path(), repo), &cfg, store.clone(), false)
+            run_with_store(opts(src.path(), repo), store.clone(), false)
                 .await
                 .is_err()
         );
@@ -1619,11 +1515,11 @@ mod resume_tests {
             )
             .await
             .unwrap();
-        let r = run_with_store(opts(src.path(), repo), &cfg, store.clone(), false).await;
+        let r = run_with_store(opts(src.path(), repo), store.clone(), false).await;
         let err = r.err().map(|e| e.to_string()).unwrap_or_default();
         assert!(err.contains("--force"), "refused with the fix: {err}");
         // --force: fresh start on the current base; the object uploaded before the kill is skipped (HEAD).
-        let r = run_with_store(opts(src.path(), repo), &cfg, store.clone(), true)
+        let r = run_with_store(opts(src.path(), repo), store.clone(), true)
             .await
             .unwrap();
         assert!(
@@ -1631,4 +1527,179 @@ mod resume_tests {
             "{r:?}"
         );
     }
+    async fn manifest(store: &Prefixed) -> Manifest {
+        let (_, bytes) = store.get_bytes(keys::MANIFEST).await.unwrap().unwrap();
+        Manifest::decode(bytes.as_ref()).unwrap()
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn replacement_preserves_settings_retired_inventory_and_unchanged_pack_scope() {
+        let src = source();
+        let store = walgit_store::memory::MemoryStore::shared();
+        let repo = "t/preserve";
+        let mut options = opts(src.path(), repo);
+        options.history_pack = false;
+        options.commit_graph = false;
+        run_with_store(options, store.clone(), false).await.unwrap();
+        let scoped = Prefixed::new(store.clone(), "repos/t/preserve/");
+        let mut before = manifest(&scoped).await;
+        before.settings = Some(walgit_proto::v1::RepoSettings {
+            toml: "[compaction]\ntrigger_packs = 7\n".into(),
+            revision: 5,
+            author: "operator".into(),
+            ..Default::default()
+        });
+        before.retired_packs.push(walgit_proto::v1::RetiredPack {
+            checksum: "ab".repeat(20),
+            retired_seq: 0,
+            retired_at: Some(time::now()),
+        });
+        before.packs[0].pack_groups = vec!["code".into()];
+        before.packs[0].ref_policy = "classified-policy".into();
+        let original_pack = before.packs[0].clone();
+        // Exercise an earlier checkpoint whose refs pointer exists only in its metadata.
+        let cp = before.checkpoint.as_mut().unwrap();
+        let (_, original_cp_bytes) = scoped.get_bytes(&cp.key).await.unwrap().unwrap();
+        let original_cp = Checkpoint::decode(original_cp_bytes.as_ref()).unwrap();
+        let old_refs_key = original_cp.refs_key;
+        cp.refs_key.clear();
+        scoped
+            .put_bytes(keys::MANIFEST, before.encode_to_vec(), PutMode::Overwrite)
+            .await
+            .unwrap();
+
+        std::fs::write(src.path().join("next"), "next commit").unwrap();
+        sh(src.path(), &["add", "."]);
+        sh(src.path(), &["commit", "-q", "-m", "next"]);
+        // Keep the original immutable pack and add a separate new pack.
+        sh(src.path(), &["repack", "-d", "-q"]);
+        sh(src.path(), &["prune-packed"]);
+        let mut options = opts(src.path(), repo);
+        options.history_pack = false;
+        options.commit_graph = false;
+        options.replace = true;
+        run_with_store(options, store.clone(), false).await.unwrap();
+        let after = manifest(&scoped).await;
+        assert_eq!(after.settings, before.settings);
+        assert_eq!(after.retired_packs, before.retired_packs);
+        assert_eq!(
+            after
+                .packs
+                .iter()
+                .find(|p| p.checksum == original_pack.checksum),
+            Some(&original_pack)
+        );
+        assert!(scoped.get_bytes(&old_refs_key).await.unwrap().is_some());
+        let cp = after.checkpoint.as_ref().unwrap();
+        assert!(cp.key.contains("/attempts/"));
+        let (_, bytes) = scoped.get_bytes(&cp.refs_key).await.unwrap().unwrap();
+        let snap = walgit_proto::snapshot::decode_verified(&cp.refs_key, &bytes).unwrap();
+        assert_eq!(snap.seq, after.head_seq);
+        assert_eq!(snap.head_target, "refs/heads/main");
+        assert_eq!(
+            snap.refs
+                .iter()
+                .find(|r| r.name == "refs/heads/main")
+                .unwrap()
+                .oid,
+            sh(src.path(), &["rev-parse", "HEAD"])
+        );
+        assert!(snap.created_at.is_none());
+
+        // A later whole-pack import retires every removed live pack and retains their bytes.
+        sh(src.path(), &["repack", "-adb", "-q"]);
+        sh(src.path(), &["prune-packed"]);
+        let mut options = opts(src.path(), repo);
+        options.history_pack = false;
+        options.commit_graph = false;
+        options.replace = true;
+        run_with_store(options, store.clone(), false).await.unwrap();
+        let replaced = manifest(&scoped).await;
+        assert_eq!(replaced.settings, before.settings);
+        for old in &after.packs {
+            assert!(replaced.serves_pack(&old.checksum));
+            assert!(
+                scoped
+                    .get_bytes(&keys::pack_key(&old.checksum))
+                    .await
+                    .unwrap()
+                    .is_some()
+            );
+            if !replaced.packs.iter().any(|p| p.checksum == old.checksum) {
+                assert!(
+                    replaced
+                        .retired_packs
+                        .iter()
+                        .any(|p| p.checksum == old.checksum && p.retired_seq == replaced.head_seq)
+                );
+            }
+        }
+        assert!(
+            replaced
+                .retired_packs
+                .iter()
+                .any(|p| p.checksum == "ab".repeat(20))
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+    async fn unknown_manifest_format_is_rejected_before_any_upload() {
+        let src = source();
+        let store = walgit_store::memory::MemoryStore::shared();
+        let scoped = Prefixed::new(store.clone(), "repos/t/unknown/");
+        let invalid = Manifest {
+            format_version: u32::MAX,
+            repo: "t/unknown".into(),
+            object_format: "sha1".into(),
+            ..Default::default()
+        };
+        scoped
+            .put_bytes(keys::MANIFEST, invalid.encode_to_vec(), PutMode::Create)
+            .await
+            .unwrap();
+        let error = run_with_store(opts(src.path(), "t/unknown"), store, false)
+            .await
+            .unwrap_err();
+        assert!(
+            format!("{error:#}").contains("unsupported manifest format"),
+            "{error:#}"
+        );
+        assert_eq!(manifest(&scoped).await, invalid);
+        let pack_dir = crate::import::resolve_git_dir(src.path())
+            .unwrap()
+            .join("objects/pack");
+        for pack in scan_packs(&pack_dir).unwrap() {
+            assert!(
+                scoped
+                    .get_bytes(&keys::pack_key(&pack.checksum))
+                    .await
+                    .unwrap()
+                    .is_none()
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn immutable_snapshot_candidates_never_overwrite_conflicting_bytes() {
+        let store = Prefixed::new(
+            walgit_store::memory::MemoryStore::shared(),
+            "repos/t/candidate/",
+        );
+        let key = "checkpoints/refs/example.pb";
+        put_snapshot_candidate(&store, key, vec![1, 2])
+            .await
+            .unwrap();
+        put_snapshot_candidate(&store, key, vec![1, 2])
+            .await
+            .unwrap();
+        assert!(
+            put_snapshot_candidate(&store, key, vec![3, 4])
+                .await
+                .is_err()
+        );
+        assert_eq!(
+            store.get_bytes(key).await.unwrap().unwrap().1.as_ref(),
+            &[1, 2]
+        );
+    }
 }
diff --git a/crates/walgit-cli/src/lib.rs b/crates/walgit-cli/src/lib.rs
index 41975b1..c7b49b3 100644
--- a/crates/walgit-cli/src/lib.rs
+++ b/crates/walgit-cli/src/lib.rs
@@ -1,4 +1,4 @@
-//! `walgit` (full CLI: serve | compact | bundle | repo | wal | synth | import | mirror | config)
+//! `walgit` (full CLI: serve | compact | repo | wal | synth | import | mirror | config)
 //! and `walgit-server` (`walgit serve` under the name a standalone deployment expects, D39),
 //! both thin bins over this library.
 //!
@@ -34,7 +34,6 @@ mod config_cmd;
 mod settings_cmd;
 mod synth;
 
-mod bundle_cmd;
 mod compact;
 mod import;
 mod import_direct;
@@ -88,7 +87,7 @@ struct ServerCli {
 
 #[derive(Subcommand)]
 enum Command {
-    /// Run the HTTP server (smart HTTP v0/v2, LFS, bundles, optional compaction/bundle loops).
+    /// Run the HTTP server (smart HTTP v0/v2, LFS, optional maintenance loops).
     Serve,
     /// Trigger compaction (geometric repack) for one repo or all.
     Compact {
@@ -101,16 +100,10 @@ enum Command {
         once: bool,
         /// Rebuild the tier-2 base: full `git repack -adb` + bitmap + commit-graph
         /// layer, published as a COMPACT entry, then a checkpoint at that seq.
-        /// Needs the whole pack set on local disk (the weekly VM job), never
-        /// a serverless host. Follow with `walgit bundle compose`.
+        /// Needs the whole pack set on local disk, never a serverless host.
         #[arg(long)]
         base: bool,
     },
-    /// Build and publish bundles.
-    Bundle {
-        #[command(subcommand)]
-        action: BundleAction,
-    },
     /// Repository management.
     Repo {
         #[command(subcommand)]
@@ -160,12 +153,6 @@ enum Command {
         /// Directory with the pack set to publish (--direct). Default: the source's objects/pack.
         #[arg(long)]
         packs: Option<PathBuf>,
-        /// (--direct) Also publish a bundle-uri full bundle = header ∘ pack (zero extra upload on GCS).
-        #[arg(long, default_value_t = true, action = clap::ArgAction::Set)]
-        bundle: bool,
-        /// (--direct) Bundle strategy name (default: first full strategy in config, else "import").
-        #[arg(long)]
-        bundle_strategy: Option<String>,
         /// (--direct) Supersede an existing non-empty repository.
         #[arg(long)]
         replace: bool,
@@ -232,47 +219,6 @@ enum Command {
     },
 }
 
-#[derive(Subcommand)]
-enum BundleAction {
-    /// Build due bundles now.
-    Run {
-        /// Restrict to one repo.
-        #[arg(long)]
-        repo: Option<String>,
-        /// Restrict to one strategy name.
-        #[arg(long)]
-        strategy: Option<String>,
-    },
-    /// Print the slot table of a repository: built / missing / unavailable / wrong-host
-    /// per strategy and slot, which host maintains it and whether that host is alive.
-    Plan {
-        /// `owner/name`.
-        repo: String,
-    },
-    /// Publish a full bundle = header ∘ tier-2 base pack via server-side compose
-    /// (no disk, no bytes through this machine). The header carries the refs at
-    /// the base's WAL seq (the checkpoint there), so the bundle is exact. Run
-    /// right after `walgit compact --base` (the weekly VM job).
-    Compose {
-        /// `owner/name`.
-        repo: String,
-        /// Strategy name (default: the first `kind = "full"` strategy).
-        #[arg(long)]
-        strategy: Option<String>,
-    },
-    /// Remove bundles from the list (CAS) and delete their objects: for entries
-    /// whose content is wrong (2026-08-21: slots cut from "now" under old tokens).
-    /// The plan then shows the slots as missing/unavailable again and the
-    /// maintainer rebuilds what is buildable (D22).
-    Rm {
-        /// `owner/name`.
-        repo: String,
-        /// Bundle ids (`<strategy>-<token>`), as shown by `bundle plan`.
-        #[arg(required = true)]
-        ids: Vec<String>,
-    },
-}
-
 #[derive(Subcommand)]
 enum RepoAction {
     /// Create a new repository.
@@ -295,8 +241,7 @@ enum RepoAction {
         #[command(subcommand)]
         action: PolicyAction,
     },
-    /// Per-repo settings in the WAL (D24): TOML overrides of [bundles],
-    /// [maintenance], [compaction] on top of the host config.
+    /// Per-repo settings in the WAL (D24): TOML overrides of [maintenance], [compaction] on top of the host config.
     Settings {
         #[command(subcommand)]
         action: SettingsAction,
@@ -524,7 +469,6 @@ async fn dispatch(command: Command, cfg: Config) -> Result<()> {
             once,
             base,
         } => compact::run(repo, all, once, base, &cfg).await,
-        Command::Bundle { action } => bundle_cmd::run(action, &cfg).await,
         Command::Repo { action } => repo::run(action, &cfg).await,
         Command::Wal { action } => wal_cmd::run(action, &cfg).await,
         Command::Mirror {
@@ -557,8 +501,6 @@ async fn dispatch(command: Command, cfg: Config) -> Result<()> {
             reuse_packs,
             direct,
             packs,
-            bundle,
-            bundle_strategy,
             replace,
             force,
             parallelism,
@@ -573,8 +515,6 @@ async fn dispatch(command: Command, cfg: Config) -> Result<()> {
                         from,
                         repo,
                         packs,
-                        bundle,
-                        bundle_strategy,
                         replace,
                         parallelism,
                         commit_graph,
diff --git a/crates/walgit-cli/src/serve.rs b/crates/walgit-cli/src/serve.rs
index 65ecca1..1e4a2d7 100644
--- a/crates/walgit-cli/src/serve.rs
+++ b/crates/walgit-cli/src/serve.rs
@@ -1,19 +1,8 @@
-//! `walgit serve` — run the HTTP server with optional compaction/bundle loops.
+//! `walgit serve` — run the HTTP server and configured maintenance loops.
 //!
-//! Opens the object store from config, builds `AppState` (which constructs the
-//! WAL registry, bundler, authenticator, semaphores, and metrics), then calls
-//! `walgit_server::serve`. When the instance's roles include `compact` and/or
-//! `bundle`, background loops are spawned:
-//!
-//!   * **compact loop** — every 60s, for every repo in `registry.list()`, if
-//!     the compaction trigger is met (tier-0 packs ≥ `trigger_packs` or bytes
-//!     ≥ `trigger_bytes`) and the compaction lease can be acquired, run
-//!     `LocalRepo::repack(geometric)` → `RepoHandle::publish_compact`.
-//!   * **bundle loop** — every 60s, `Bundler::run_all_due`.
-//!   * **maintain** role — `walgit_server::maintain::run_loop`: checkpoint-if-due
-//!     (refs-level), bundles-if-due and geometric compaction for every repo, each
-//!     as a task. It subsumes the two loops above (they are skipped when the
-//!     instance is a maintainer so work is not done twice).
+//! Opens the object store and constructs the WAL registry, authenticator,
+//! semaphores and metrics. The maintain role runs bounded maintenance tasks
+//! and upstream following; otherwise the compact role runs bounded pack lifecycle units.
 
 use std::sync::Arc;
 
@@ -33,7 +22,7 @@ pub async fn run(cfg: &Arc<Config>) -> Result<()> {
     // Ensure the cache directory exists.
     std::fs::create_dir_all(&cfg.cache.dir).ok();
 
-    // AppState::new constructs the registry, bundler, auth, semaphores, metrics.
+    // AppState::new constructs the registry, auth, semaphores, metrics.
     let state = AppState::new(cfg.clone(), store).await?;
 
     // Spawn background loops for non-serving roles.
@@ -61,14 +50,6 @@ pub async fn run(cfg: &Arc<Config>) -> Result<()> {
         }));
     }
 
-    if !maintainer && cfg.has_role(Role::Bundle) {
-        let b = state.bundles.clone();
-        let c = cfg.clone();
-        bg_handles.push(tokio::spawn(async move {
-            bundle_loop(b, c).await;
-        }));
-    }
-
     // Graceful shutdown on SIGTERM / SIGINT.
     let shutdown = async {
         #[cfg(unix)]
@@ -102,20 +83,20 @@ pub async fn run(cfg: &Arc<Config>) -> Result<()> {
 
 /// Compaction loop: every 60s, check each repo for compaction triggers.
 async fn compact_loop(registry: Arc<walgit_wal::Registry>, cfg: Arc<Config>) {
-    if !cfg.compaction.enabled {
-        info!("compaction disabled by config, loop exiting");
+    if !cfg.packs.enabled {
+        info!("pack maintenance disabled by config, loop exiting");
         return;
     }
     let interval = std::time::Duration::from_mins(1);
     loop {
         tokio::time::sleep(interval).await;
-        if let Err(e) = run_compaction_pass(&registry, &cfg).await {
+        if let Err(e) = run_compaction_pass(&registry).await {
             warn!(error = %e, "compaction pass failed");
         }
     }
 }
 
-async fn run_compaction_pass(registry: &walgit_wal::Registry, cfg: &Config) -> anyhow::Result<()> {
+async fn run_compaction_pass(registry: &walgit_wal::Registry) -> anyhow::Result<()> {
     let repos = registry.list().await?;
     for id in repos {
         let handle = match registry.open(&id).await {
@@ -133,7 +114,6 @@ async fn run_compaction_pass(registry: &walgit_wal::Registry, cfg: &Config) -> a
         let log = |line: String| info!(repo = %id, "{line}");
         match walgit_server::ops::compact_repo(
             &handle,
-            cfg,
             walgit_server::ops::CompactRequest::default(),
             &log,
         )
@@ -145,19 +125,3 @@ async fn run_compaction_pass(registry: &walgit_wal::Registry, cfg: &Config) -> a
     }
     Ok(())
 }
-
-/// Bundle loop: every 60s, run all due bundle strategies.
-async fn bundle_loop(bundler: Arc<walgit_bundle::Bundler>, cfg: Arc<Config>) {
-    if !cfg.bundles.enabled {
-        info!("bundles disabled by config, loop exiting");
-        return;
-    }
-    let interval = std::time::Duration::from_mins(1);
-    loop {
-        tokio::time::sleep(interval).await;
-        let now = std::time::SystemTime::now();
-        if let Err(e) = bundler.run_all_due(now).await {
-            warn!(error = %e, "bundle pass failed");
-        }
-    }
-}
diff --git a/crates/walgit-config/Cargo.toml b/crates/walgit-config/Cargo.toml
index 1fa19f3..9c10f6f 100644
--- a/crates/walgit-config/Cargo.toml
+++ b/crates/walgit-config/Cargo.toml
@@ -5,8 +5,9 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
+sha2.workspace = true
+hex.workspace = true
 tracing.workspace = true
-cron.workspace = true
 anyhow.workspace = true
 serde.workspace = true
 toml.workspace = true
diff --git a/crates/walgit-config/src/lib.rs b/crates/walgit-config/src/lib.rs
index 24ad54c..e3cdaf1 100644
--- a/crates/walgit-config/src/lib.rs
+++ b/crates/walgit-config/src/lib.rs
@@ -2,6 +2,11 @@
 //! `WALGIT__SECTION__KEY=value` (double underscore = nesting), applied after
 //! the file is parsed. `PORT` (a serverless host) overrides `server.listen` port.
 
+pub mod packs;
+pub use packs::{DeltaBudget, FoldInventory, FoldReason, FreezeReason, PacksConfig};
+pub mod refs;
+pub use refs::{PackGroupConfig, PackGroupKind, RefsConfig};
+
 use std::{net::SocketAddr, path::PathBuf, time::Duration};
 
 use anyhow::{Context, Result};
@@ -17,8 +22,9 @@ pub struct Config {
     pub store: StoreConfig,
     pub cache: CacheConfig,
     pub wal: WalConfig,
-    pub compaction: CompactionConfig,
-    pub bundles: BundlesConfig,
+    pub packs: PacksConfig,
+    pub refs: RefsConfig,
+    pub packfile_uri: PackfileUriConfig,
     pub maintenance: MaintenanceConfig,
     pub placement: PlacementConfig,
     pub lfs: LfsConfig,
@@ -50,16 +56,16 @@ pub struct ServerConfig {
     /// Max size of a single pushed pack accepted over HTTP.
     pub max_push_bytes: ByteSize,
     /// Roles this instance performs. a serverless host: fronts get `["serve"]`, the
-    /// single maintenance instance `["maintain"]` (checkpoint / bundle / compact
-    /// loops over every repo; `compact` and `bundle` are its sub-roles). Empty = all.
+    /// single maintenance instance `["maintain"]` (checkpoint / compact
+    /// loops over every repo; `compact` is its sub-role). Empty = all.
     pub roles: Vec<Role>,
     pub auth: AuthConfig,
-    /// Public base URL used when rendering absolute URIs (bundle lists, LFS).
+    /// Public base URL used when rendering absolute URIs (LFS, clone recipes).
     pub public_url: Option<String>,
     /// Create a repo on the first receive-pack push if it does not exist.
     pub auto_create_on_push: bool,
     /// Honour `X-Walgit-Capabilities: accel-redirect` from an nginx edge
-    /// (`deploy/nginx.conf.example`): static objects (bundles, LFS) are answered with
+    /// (`deploy/nginx.conf.example`): static objects (LFS) are answered with
     /// `X-Accel-Redirect: /_store/` + `X-Walgit-Store-Url` (and `-Authorization`) and no
     /// body, so nginx streams (and caches) the bytes itself. Only turn it on behind an
     /// edge that strips the capability header from clients: the answer carries a store
@@ -123,10 +129,8 @@ impl Default for TlsConfig {
 pub enum Role {
     Serve,
     Compact,
-    Bundle,
-    /// Background maintenance loop: checkpoint-if-due (refs-level), bundles-if-
-    /// due, geometric compaction for repos whose pack set fits. Implies
-    /// `Compact` + `Bundle`.
+    /// Background maintenance loop: checkpoints and geometric compaction
+    /// for repos whose pack set fits. Implies `Compact`.
     Maintain,
     /// The events bridge (`docs/EVENTS.md`): tails every repo's WAL from a
     /// per-repo cursor and publishes `ref` events to the bus sinks (webhook,
@@ -139,7 +143,7 @@ pub enum Role {
 #[serde(deny_unknown_fields, default)]
 pub struct AuthConfig {
     pub mode: AuthMode,
-    /// Allow unauthenticated read (upload-pack, bundles, web UI) when mode != none.
+    /// Allow unauthenticated read (upload-pack, LFS, web UI) when mode != none.
     pub anonymous_read: bool,
     /// Static tokens (`token` mode, and accepted in `oidc` mode too — for robots): token → principal.
     /// Presented as `Authorization: Bearer <token>` or as the password of HTTP Basic.
@@ -256,7 +260,7 @@ pub struct GcsConfig {
     /// Service account for signed URLs; None = ADC/IAM signBlob.
     pub signing_service_account: Option<String>,
     /// Separate data clients (own channels) for bulk traffic — pack/idx/side-
-    /// file/bundle/LFS bytes and ranged reads — so the control plane
+    /// file/LFS bytes and ranged reads — so the control plane
     /// (manifest, log, checkpoint, lease GETs/PUTs) never queues behind a
     /// multi-GB download on a shared HTTP/2 connection.
     #[serde(default = "default_bulk_clients")]
@@ -316,8 +320,6 @@ pub struct CacheConfig {
     pub ref_advert_entries: usize,
     /// Max entries in the object-info (size/has) cache.
     pub object_info_entries: usize,
-    /// Max entries in the bundle list render cache.
-    pub bundle_list_entries: usize,
     /// Process-wide LRU of pack data blocks (1 MiB range reads) used when a
     /// repo's pack set does not fit `max_bytes` and objects are read straight
     /// from the object store.
@@ -376,7 +378,7 @@ pub struct WalConfig {
     /// Skip the index freshness GET if the last check was younger than this (0 = always check).
     #[serde(with = "humantime_serde")]
     pub freshness_ttl: Duration,
-    /// After a refs-only sync (info/refs, ls-refs, bundle-uri, web refs) on a
+    /// After a refs-only sync (info/refs, ls-refs, web refs) on a
     /// copy whose packs are not yet reconciled, start downloading the packs in
     /// the background so the first fetch does not pay for it.
     pub prefetch_packs: bool,
@@ -472,9 +474,9 @@ impl Default for MaintenanceConfig {
 /// * **serve**: object work — `git-upload-pack`, `git-receive-pack`, LFS transfer. A
 ///   host that does not serve a repo answers those with 503 + `Retry-After` (+ a band-3
 ///   line naming the host that does) *before* any sync or materialize; refs-level
-///   reads (info/refs, the API via the remote reader, UI, bundle list) stay available
+///   reads (info/refs, the API via the remote reader, UI) stay available
 ///   everywhere, so the edge's read-only fallback (D29) works.
-/// * **maintain**: the maintainer loop's units (checkpoints, bundles, compaction,
+/// * **maintain**: the maintainer loop's units (checkpoints, compaction,
 ///   fsck/repair) — only on hosts with the `maintain` role.
 ///
 /// Placement is by rule, not by capacity: a repo is either this host's or not.
@@ -510,156 +512,19 @@ impl PlacementConfig {
     }
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields, default)]
-pub struct CompactionConfig {
-    pub enabled: bool,
-    /// Geometric factor between tiers.
-    pub factor: u32,
-    /// Compact when this many fresh (tier 0) packs exist.
-    pub trigger_packs: usize,
-    /// Or when fresh pack bytes exceed this.
-    pub trigger_bytes: ByteSize,
-    #[serde(with = "humantime_serde")]
-    pub lease_ttl: Duration,
-    /// Keep superseded packs and old index generations for this long (provenance/rewind).
-    #[serde(with = "humantime_serde")]
-    pub retention_superseded: Duration,
-    /// Use upstream git for delta compression (`git repack`); gix does not delta-compress.
-    pub engine: RepackEngine,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
-#[serde(rename_all = "snake_case")]
-pub enum RepackEngine {
-    #[default]
-    Git,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields, default)]
-#[expect(
-    clippy::struct_excessive_bools,
-    reason = "Independent configuration switches, not mutually exclusive states"
-)]
-pub struct BundlesConfig {
-    pub enabled: bool,
-    pub strategy: Vec<BundleStrategy>,
-    /// Minimum-size gate for **incremental** slots: a slot whose content
-    /// (commits on the bundle's refs since its base bundle's tips) has fewer
-    /// commits than this is not built (plan state `too-small`; the next slot of
-    /// the strategy is built on the same base, so nothing is lost). Fulls are
-    /// never gated. 0 = no gate. Per-strategy `min_commits` overrides.
-    #[serde(default = "default_min_commits")]
-    pub min_commits: u64,
-    /// Optional second guard: skip incrementals whose pack would be smaller
-    /// than this (0 = off).
-    #[serde(default)]
-    pub min_bytes: ByteSize,
-    pub serve_via: BundleServe,
-    #[serde(with = "humantime_serde")]
-    pub signed_url_ttl: Duration,
-    /// Advertise `bundle-uri` in protocol v2 capabilities.
-    pub advertise: bool,
-    /// Put the filtered families INTO the plain `bundles/list` and the v2
-    /// advertisement (with their `bundle.<id>.filter` lines) instead of only
-    /// at `bundles/list?filter=…`. Only for clients whose git matches
-    /// `bundle.<id>.filter` against the clone's filter (a patched Git client
-    /// patch, `docs/patches/`): stock git ignores the key and a full clone
-    /// would swallow the blobless bundles (design §6b). Default false.
-    #[serde(default)]
-    pub advertise_filtered: bool,
-    /// Repositories (`owner/name`, or `owner/*`) whose clones **must** go
-    /// through bundle-uri: a fetch with zero `have`s gets a pkt ERR / band-3
-    /// message with the exact fix instead of an impossible full pack. Fetches
-    /// with haves proceed normally.
-    #[serde(default)]
-    pub require: Vec<String>,
-    /// Repositories (`owner/name` | `owner/*`) whose bundle URIs are always
-    /// signed store URLs regardless of `serve_via`: clone bytes of the biggest
-    /// repos bypass the fronts entirely.
-    #[serde(default)]
-    pub signed_url_for: Vec<String>,
-    /// Default ref set of a bundle when a strategy has no `refs`: `HEAD` +
-    /// `refs/heads/main` when true (branches are tiny per-fetch deltas on top
-    /// of main; bundling every branch makes rebased branches *slower* to
-    /// fetch, not faster), `refs/heads/*` + `refs/tags/*` + `HEAD` when false.
-    #[serde(default = "default_true")]
-    pub main_only: bool,
-    /// Extra ref globs added to every bundle's default ref set (e.g. `refs/tags/v*`).
-    #[serde(default)]
-    pub extra_refs: Vec<String>,
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, Default)]
 #[serde(rename_all = "snake_case")]
-pub enum BundleServe {
+pub enum LfsServe {
     #[default]
     Proxy,
     SignedUrl,
 }
 
-#[derive(Debug, Clone, Serialize, Deserialize)]
-#[serde(deny_unknown_fields)]
-pub struct BundleStrategy {
-    pub name: String,
-    pub kind: BundleKind,
-    /// Cron expression (6 or 7 fields, `cron` crate syntax) or "@hourly"/"@daily"/"@weekly".
-    pub schedule: String,
-    /// For incremental: name of the strategy this one is based on.
-    #[serde(default)]
-    pub base: Option<String>,
-    /// Full strategies only: how many newest fulls stay listed (>= 1). Incrementals have
-    /// no knob — always the 2 newest whose base is kept (`walgit_bundle::slots::INCREMENTALS_KEPT`,
-    /// D21 amended 2026-08-22); setting `keep` on one is a configuration error.
-    #[serde(default)]
-    pub keep: usize,
-    /// Ref globs included in the bundle. Default: see `bundles.main_only`.
-    #[serde(default)]
-    pub refs: Vec<String>,
-    /// Backfill horizon: how many missing slots (oldest first) one maintainer
-    /// pass may build for this strategy (0 = unlimited). Keeps a long outage
-    /// from turning into hours of catch-up in one pass.
-    #[serde(default)]
-    pub backfill_max: usize,
-    /// Override of `bundles.min_commits` for this strategy (None = inherit).
-    #[serde(default)]
-    pub min_commits: Option<u64>,
-    /// Object filter of the bundles this strategy builds (`"blob:none"` is the
-    /// only supported value): a **blobless family** for `--filter=blob:none`
-    /// clones. A full strategy with a filter composes the D18 history pack
-    /// (commits + trees) under a `@filter=blob:none` header; incrementals pack
-    /// with `--filter=blob:none`. Whole chains share one filter. Filtered
-    /// bundles are advertised only at `bundles/list?filter=blob:none` — never
-    /// in the protocol-advertised list: git (2.47 … master) does not match
-    /// `bundle.<id>.filter` against the clone's filter, so a full clone would
-    /// swallow them and end up with promisor packs it cannot complete.
-    #[serde(default)]
-    pub filter: Option<String>,
-    /// Incrementals only. `false` (default, D21): every slot is cut on its **base** (a daily on the
-    /// weekly, an hourly on the newest daily), so the newest one subsumes the older ones and only the
-    /// 2 newest are listed — a fresh clone is 5 downloads, a catch-up ≤ 2, bytes overlap.
-    /// `true`: a slot is cut on this strategy's **own previous bundle** when that one is newer than
-    /// the newest base bundle at or before the slot (dailies chain from the weekly, hourlies restart
-    /// from each daily); every slot since the base is listed (≤ 7 dailies, ≤ 24 hourlies) and each
-    /// carries exactly its delta — more downloads, no overlapping bytes, a catch-up is exactly the
-    /// slots missed. `walgit_bundle::slots` is the one place that knows either rule.
-    #[serde(default)]
-    pub chain: bool,
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum BundleKind {
-    Full,
-    Incremental,
-}
-
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(deny_unknown_fields, default)]
 pub struct LfsConfig {
     pub enabled: bool,
-    pub serve_via: BundleServe,
+    pub serve_via: LfsServe,
     #[serde(with = "humantime_serde")]
     pub signed_url_ttl: Duration,
     pub max_object_bytes: ByteSize,
@@ -700,7 +565,7 @@ pub struct UpstreamConfig {
     reason = "Independent configuration switches, not mutually exclusive states"
 )]
 pub struct GitConfig {
-    /// Path to the upstream git binary (repack, bundle, optional upload-pack engine).
+    /// Path to the upstream git binary (repack, optional upload-pack engine).
     pub binary: PathBuf,
     pub upload_pack_engine: UploadPackEngine,
     pub allow_filter: bool,
@@ -812,15 +677,13 @@ pub enum LogFormat {
     Pretty,
 }
 
-fn default_min_commits() -> u64 {
-    25
-}
 fn default_true() -> bool {
     true
 }
 
 /// D24: the top-level sections a repository's settings may override.
-pub const SETTINGS_SECTIONS: &[&str] = &["bundles", "maintenance", "compaction", "upstream"];
+pub const SETTINGS_SECTIONS: &[&str] =
+    &["maintenance", "packs", "upstream", "refs", "packfile_uri"];
 /// D24: maximum size of a settings document.
 pub const SETTINGS_MAX_BYTES: usize = 16 * 1024;
 
@@ -898,102 +761,6 @@ impl Config {
             CacheMode::Auto => self.maintenance.disk == MaintainerDisk::Ssd,
         }
     }
-    /// Bundle strategies form chains of calendar slots (`docs/BUNDLE_URI_DESIGN.md` §4):
-    /// every `schedule` is a 6-field UTC cron (or an `@alias`) that parses; an
-    /// incremental names a `base` that exists and whose chain ends in a full
-    /// strategy; each chain has exactly one full root; `keep >= 1` on fulls.
-    fn validate_bundle_strategies(&self) -> Result<()> {
-        use std::collections::HashMap;
-        let strategies = &self.bundles.strategy;
-        let by_name: HashMap<&str, &BundleStrategy> =
-            strategies.iter().map(|s| (s.name.as_str(), s)).collect();
-        anyhow::ensure!(
-            by_name.len() == strategies.len(),
-            "bundles.strategy: duplicate strategy names"
-        );
-        for s in strategies {
-            let expr = s.schedule.trim();
-            let fields = expr.split_whitespace().count();
-            anyhow::ensure!(
-                expr.starts_with('@') || fields == 6 || fields == 7,
-                "bundles.strategy {}: schedule {:?} must be a 6-field UTC cron (sec min hour dom mon dow) or @hourly/@daily/@weekly",
-                s.name,
-                s.schedule
-            );
-            cron::Schedule::from_str(expr).map_err(|e| {
-                anyhow::anyhow!(
-                    "bundles.strategy {}: schedule {:?} does not parse: {e}",
-                    s.name,
-                    s.schedule
-                )
-            })?;
-            if let Some(f) = &s.filter {
-                anyhow::ensure!(
-                    f == "blob:none",
-                    "bundles.strategy {}: filter {f:?} is not supported (only \"blob:none\")",
-                    s.name
-                );
-            }
-            match s.kind {
-                BundleKind::Full => {
-                    anyhow::ensure!(
-                        s.base.is_none(),
-                        "bundles.strategy {}: a full strategy has no base",
-                        s.name
-                    );
-                    anyhow::ensure!(
-                        !s.chain,
-                        "bundles.strategy {}: `chain` is an incremental knob",
-                        s.name
-                    );
-                    anyhow::ensure!(
-                        s.keep >= 1,
-                        "bundles.strategy {}: keep must be >= 1 on a full strategy",
-                        s.name
-                    );
-                }
-                BundleKind::Incremental => {
-                    anyhow::ensure!(
-                        s.keep == 0,
-                        "bundles.strategy {}: `keep` is not a knob on an incremental strategy — the 2 newest whose base is kept are always listed (D21, 2026-08-22); remove it",
-                        s.name
-                    );
-                    let mut cur = s;
-                    let mut hops = 0;
-                    loop {
-                        let base = cur.base.as_deref().ok_or_else(|| {
-                            anyhow::anyhow!("bundles.strategy {}: incremental needs base", cur.name)
-                        })?;
-                        let b = by_name.get(base).ok_or_else(|| {
-                            anyhow::anyhow!(
-                                "bundles.strategy {}: base {base} is not a strategy",
-                                cur.name
-                            )
-                        })?;
-                        anyhow::ensure!(
-                            b.filter == s.filter,
-                            "bundles.strategy {}: filter {:?} differs from its base {}'s {:?} (a chain shares one filter)",
-                            s.name,
-                            s.filter,
-                            b.name,
-                            b.filter
-                        );
-                        if b.kind == BundleKind::Full {
-                            break;
-                        }
-                        cur = b;
-                        hops += 1;
-                        anyhow::ensure!(
-                            hops < 16,
-                            "bundles.strategy {}: base chain has a cycle",
-                            s.name
-                        );
-                    }
-                }
-            }
-        }
-        Ok(())
-    }
 }
 
 /// `owner/name` matches an entry of `list` (`owner/name`, `owner/*`, `*`; `.git` tolerated).
@@ -1116,7 +883,6 @@ impl Default for CacheConfig {
             prewarm_ready_timeout: Duration::ZERO,
             ref_advert_entries: 256,
             object_info_entries: 4096,
-            bundle_list_entries: 128,
             remote_block_bytes: ByteSize::gib(1),
             remote_object_bytes: ByteSize::mib(256),
             shared_render_cache: true,
@@ -1145,80 +911,11 @@ impl Default for WalConfig {
         }
     }
 }
-impl Default for CompactionConfig {
-    fn default() -> Self {
-        CompactionConfig {
-            enabled: true,
-            factor: 2,
-            trigger_packs: 16,
-            trigger_bytes: ByteSize::gib(1),
-            lease_ttl: Duration::from_mins(10),
-            retention_superseded: Duration::from_hours(168),
-            engine: RepackEngine::Git,
-        }
-    }
-}
-impl Default for BundlesConfig {
-    fn default() -> Self {
-        BundlesConfig {
-            enabled: true,
-            strategy: vec![
-                BundleStrategy {
-                    name: "weekly".into(),
-                    kind: BundleKind::Full,
-                    // Sunday 23:00 UTC (slot = fire time; backfilled when missed).
-                    schedule: "0 0 23 * * Sun".into(),
-                    base: None,
-                    keep: 2,
-                    refs: vec![],
-                    backfill_max: 0,
-                    min_commits: None,
-                    filter: None,
-                    chain: false,
-                },
-                BundleStrategy {
-                    name: "daily".into(),
-                    kind: BundleKind::Incremental,
-                    schedule: "0 0 23 * * *".into(),
-                    base: Some("weekly".into()),
-                    keep: 0,
-                    refs: vec![],
-                    backfill_max: 0,
-                    min_commits: None,
-                    filter: None,
-                    chain: true,
-                },
-                BundleStrategy {
-                    name: "hourly".into(),
-                    kind: BundleKind::Incremental,
-                    schedule: "@hourly".into(),
-                    base: Some("daily".into()),
-                    keep: 0,
-                    refs: vec![],
-                    backfill_max: 0,
-                    min_commits: None,
-                    filter: None,
-                    chain: false,
-                },
-            ],
-            serve_via: BundleServe::Proxy,
-            signed_url_ttl: Duration::from_hours(1),
-            advertise: true,
-            advertise_filtered: false,
-            require: Vec::new(),
-            signed_url_for: Vec::new(),
-            main_only: true,
-            extra_refs: Vec::new(),
-            min_commits: 25,
-            min_bytes: ByteSize::b(0),
-        }
-    }
-}
 impl Default for LfsConfig {
     fn default() -> Self {
         LfsConfig {
             enabled: true,
-            serve_via: BundleServe::Proxy,
+            serve_via: LfsServe::Proxy,
             signed_url_ttl: Duration::from_hours(1),
             max_object_bytes: ByteSize::gib(16),
         }
@@ -1380,6 +1077,16 @@ impl Config {
     }
 
     pub fn validate(&self) -> Result<()> {
+        self.refs.validate()?;
+        self.packs.validate()?;
+        anyhow::ensure!(
+            self.packfile_uri.uri_min_bytes.as_u64() > 0,
+            "packfile_uri.uri_min_bytes must be positive"
+        );
+        anyhow::ensure!(
+            (1..=64).contains(&self.packfile_uri.max_uris_per_fetch),
+            "packfile_uri.max_uris_per_fetch must be 1..=64"
+        );
         anyhow::ensure!(!self.store.bucket.is_empty(), "store.bucket must be set");
         let t = &self.server.tls;
         match t.mode {
@@ -1405,7 +1112,6 @@ impl Config {
                 "server.public_url must be an http(s) origin (got {u})"
             );
         }
-        self.validate_bundle_strategies()?;
         // You cannot maintain what you refuse to serve: a host with the serve role
         // whose maintain rules name a repository its serve rules exclude is a config
         // error (the SSD host 2026-08-21 07:00Z: maintain = ["acme/monorepo"], inherited
@@ -1529,46 +1235,7 @@ impl Config {
                 "server.auth.session_secret is required with oauth_client_id (it signs sessions and access tokens)"
             );
         }
-        anyhow::ensure!(
-            self.compaction.factor >= 2,
-            "compaction.factor must be >= 2"
-        );
         anyhow::ensure!(self.wal.max_batch >= 1, "wal.max_batch must be >= 1");
-        let names: std::collections::HashSet<&str> = self
-            .bundles
-            .strategy
-            .iter()
-            .map(|s| s.name.as_str())
-            .collect();
-        anyhow::ensure!(
-            names.len() == self.bundles.strategy.len(),
-            "bundle strategy names must be unique"
-        );
-        for s in &self.bundles.strategy {
-            match (s.kind, &s.base) {
-                (BundleKind::Incremental, None) => {
-                    anyhow::bail!("bundle strategy {} is incremental but has no base", s.name)
-                }
-                (BundleKind::Incremental, Some(b)) => {
-                    anyhow::ensure!(
-                        names.contains(b.as_str()),
-                        "bundle strategy {} base {b} does not exist",
-                        s.name
-                    );
-                }
-                (BundleKind::Full, Some(_)) => {
-                    anyhow::bail!("bundle strategy {} is full but has a base", s.name)
-                }
-                _ => {}
-            }
-            if matches!(s.kind, BundleKind::Full) {
-                anyhow::ensure!(
-                    s.keep >= 1,
-                    "bundle strategy {}: keep must be >= 1 on a full strategy",
-                    s.name
-                );
-            }
-        }
         if let Some(u) = &self.events.webhook_url {
             anyhow::ensure!(
                 u.starts_with("http://") || u.starts_with("https://"),
@@ -1588,21 +1255,6 @@ impl Config {
         }
     }
 
-    /// Whether `owner/name` is listed in `bundles.require` (exact or `owner/*`).
-    pub fn bundles_required(&self, owner: &str, name: &str) -> bool {
-        repo_listed(&self.bundles.require, owner, name)
-    }
-
-    /// How `owner/name`'s bundle URIs are served: `bundles.serve_via`, or
-    /// signed URLs when listed in `bundles.signed_url_for`.
-    pub fn bundle_serve_via(&self, owner: &str, name: &str) -> BundleServe {
-        if repo_listed(&self.bundles.signed_url_for, owner, name) {
-            BundleServe::SignedUrl
-        } else {
-            self.bundles.serve_via
-        }
-    }
-
     /// Whether this process terminates TLS itself (D39 standalone shape).
     pub fn tls_enabled(&self) -> bool {
         self.server.tls.mode != TlsMode::Off
@@ -1644,8 +1296,7 @@ impl Config {
     pub fn has_role(&self, role: Role) -> bool {
         self.server.roles.is_empty()
             || self.server.roles.contains(&role)
-            || (matches!(role, Role::Compact | Role::Bundle)
-                && self.server.roles.contains(&Role::Maintain))
+            || (matches!(role, Role::Compact) && self.server.roles.contains(&Role::Maintain))
     }
 }
 
@@ -1696,7 +1347,6 @@ mod tests {
     fn defaults_parse_and_validate() {
         let c = Config::parse("").unwrap();
         assert_eq!(c.server.listen.port(), 8080);
-        assert_eq!(c.bundles.strategy.len(), 3);
         c.validate().unwrap();
         // Round trip through TOML.
         let text = toml::to_string(&c).unwrap();
@@ -1704,6 +1354,12 @@ mod tests {
         assert_eq!(back.store.bucket, c.store.bucket);
     }
 
+    #[test]
+    fn example_configurations_parse_and_validate() {
+        Config::parse(include_str!("../../../walgit.example.toml")).unwrap();
+        Config::parse(include_str!("../../../walgit.standalone.toml")).unwrap();
+    }
+
     #[test]
     fn env_overrides() {
         let mut c = Config::default();
@@ -1858,6 +1514,41 @@ mod tests {
         .unwrap();
     }
 
+    #[test]
+    fn removed_bundle_configuration_is_rejected() {
+        for input in [
+            "[bundles]\nenabled = true\n",
+            "[server]\nroles = [\"bundle\"]\n",
+            "[cache]\nbundle_list_entries = 128\n",
+        ] {
+            assert!(Config::parse(input).is_err(), "{input}");
+        }
+        let mut base = Config::default();
+        base.store.bucket = "b".into();
+        assert!(base.with_settings("[bundles]\nenabled = false\n").is_err());
+        assert!(!base.public_settings_toml().unwrap().contains("[bundles]"));
+    }
+
+    #[test]
+    fn removed_compaction_configuration_is_rejected() {
+        for input in [
+            "[compaction]\nenabled = true\n",
+            "[packs]\nfactor = 2\n",
+            "[packs]\ntrigger_bytes = \"1GiB\"\n",
+            "[packs]\nretention_superseded = \"7d\"\n",
+            "[packs]\nengine = \"git\"\n",
+        ] {
+            assert!(Config::parse(input).is_err(), "{input}");
+            assert!(Config::default().with_settings(input).is_err(), "{input}");
+        }
+        assert!(
+            !Config::default()
+                .public_settings_toml()
+                .unwrap()
+                .contains("[compaction]")
+        );
+    }
+
     #[test]
     fn settings_merge_over_config_and_are_restricted() {
         let mut base = Config::default();
@@ -1865,20 +1556,17 @@ mod tests {
         let eff = base
             .with_settings(
                 r"
-[bundles]
-min_commits = 3
-main_only = false
+[packs]
+geometric_factor = 3
 [maintenance]
 checkpoints = false
 ",
             )
             .unwrap();
-        assert_eq!(eff.bundles.min_commits, 3);
-        assert!(!eff.bundles.main_only);
+        assert_eq!(eff.packs.geometric_factor, 3);
         assert!(!eff.maintenance.checkpoints);
         assert_eq!(
-            eff.bundles.strategy.len(),
-            base.bundles.strategy.len(),
+            eff.packs.fold_when_fresh_packs_reach, base.packs.fold_when_fresh_packs_reach,
             "untouched keys keep the host's values"
         );
         // Forbidden section.
@@ -1893,16 +1581,16 @@ listen = \"0.0.0.0:1\"\n",
         // A section the docs once promised but the code never accepted.
         assert!(base.with_settings("[integrations]\nx = 1\n").is_err());
         // Unknown key inside an allowed section.
-        assert!(base.with_settings("[bundles]\nnope = 1\n").is_err());
-        // Invalid effective config (incremental without a base).
+        assert!(base.with_settings("[packs]\nnope = 1\n").is_err());
+        // Invalid effective config (geometric factor below two).
         let e = base
-            .with_settings("[[bundles.strategy]]\nname = \"x\"\nkind = \"incremental\"\nschedule = \"@hourly\"\n")
+            .with_settings("[packs]\ngeometric_factor = 1\n")
             .unwrap_err()
             .to_string();
         assert!(e.contains("settings"), "{e}");
         assert_eq!(
-            base.with_settings("  ").unwrap().bundles.min_commits,
-            base.bundles.min_commits
+            base.with_settings("  ").unwrap().packs.geometric_factor,
+            base.packs.geometric_factor
         );
         let e = base
             .with_settings("[upstream]\ntoken_env = \"AWS_SECRET_ACCESS_KEY\"\n")
@@ -1910,7 +1598,7 @@ listen = \"0.0.0.0:1\"\n",
             .to_string();
         assert!(e.contains("token_env"), "{e}");
         let pub_toml = base.public_settings_toml().unwrap();
-        assert!(pub_toml.contains("[bundles]"), "{pub_toml}");
+        assert!(pub_toml.contains("[packs]"), "{pub_toml}");
         assert!(!pub_toml.contains("session_secret"), "{pub_toml}");
         assert!(!pub_toml.contains("[server]"), "{pub_toml}");
         assert!(!pub_toml.contains("token_env"), "{pub_toml}");
@@ -1993,62 +1681,20 @@ webhook_secret = "s"
         let err = Config::parse("[events]\nwebhook_url = \"ftp://x\"\n").unwrap_err();
         assert!(err.to_string().contains("webhook_url"), "{err}");
     }
-
-    #[test]
-    fn rejects_bad_bundle_graph() {
-        let text = r#"
-[[bundles.strategy]]
-name = "daily"
-kind = "incremental"
-schedule = "@daily"
-keep = 3
-"#;
-        assert!(Config::parse(text).is_err());
-    }
 }
 
-#[cfg(test)]
-mod bundle_strategy_validation {
-    use super::*;
-
-    fn base() -> Config {
-        let mut c = Config::default();
-        c.store.bucket = "b".into();
-        c
-    }
-
-    #[test]
-    fn defaults_validate() {
-        base().validate().unwrap();
-    }
-
-    #[test]
-    fn bad_schedule_incremental_without_full_root_and_keep_zero_are_rejected() {
-        let mut c = base();
-        c.bundles.strategy[2].schedule = "every hour".into();
-        assert!(c.validate().unwrap_err().to_string().contains("schedule"));
-        let mut c = base();
-        c.bundles.strategy[1].base = Some("nope".into());
-        assert!(
-            c.validate()
-                .unwrap_err()
-                .to_string()
-                .contains("not a strategy")
-        );
-        let mut c = base();
-        c.bundles.strategy[0].keep = 0;
-        assert!(c.validate().unwrap_err().to_string().contains("keep"));
-        let mut c = base();
-        c.bundles.strategy[2].keep = 28;
-        assert!(
-            c.validate()
-                .unwrap_err()
-                .to_string()
-                .contains("not a knob on an incremental")
-        );
-        let mut c = base();
-        c.bundles.strategy[1].base = Some("hourly".into());
-        c.bundles.strategy[2].base = Some("daily".into());
-        assert!(c.validate().unwrap_err().to_string().contains("cycle"));
+/// Negotiated static delivery thresholds. Foundation only: no URI emission yet.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
+pub struct PackfileUriConfig {
+    pub uri_min_bytes: ByteSize,
+    pub max_uris_per_fetch: usize,
+}
+impl Default for PackfileUriConfig {
+    fn default() -> Self {
+        Self {
+            uri_min_bytes: ByteSize::mib(32),
+            max_uris_per_fetch: 64,
+        }
     }
 }
diff --git a/crates/walgit-config/src/packs.rs b/crates/walgit-config/src/packs.rs
new file mode 100644
index 0000000..cd12bad
--- /dev/null
+++ b/crates/walgit-config/src/packs.rs
@@ -0,0 +1,372 @@
+//! Pack lifecycle policy. These decisions schedule work; they never certify graph
+//! coverage, authorize URI delivery, or permit retiring an input before a seal.
+use std::time::Duration;
+
+use anyhow::{Result, ensure};
+use serde::{Deserialize, Serialize};
+
+use crate::ByteSize;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
+pub struct PacksConfig {
+    pub enabled: bool,
+    pub geometric_factor: u32,
+    pub fold_when_fresh_packs_reach: usize,
+    #[serde(with = "humantime_serde")]
+    pub fold_when_max_age: Duration,
+    pub fold_needs_at_least_packs: usize,
+    /// Target passed to Git's max-pack-size, not an absolute oversized-object cap.
+    pub segment_max_bytes: ByteSize,
+    /// Zero derives the planning target from `segment_max_bytes`.
+    pub segment_target_bytes: ByteSize,
+    pub segment_delta_window: u32,
+    pub segment_delta_depth: u32,
+    /// Whole operation delta-search budget, divided across resolved threads.
+    /// This does not bound the process's full RSS.
+    pub segment_delta_window_memory: ByteSize,
+    pub segment_reuse_objects: bool,
+    /// Zero resolves available CPUs. Explicit values remain bounded by that availability.
+    pub segment_threads: usize,
+    #[serde(with = "humantime_serde")]
+    pub freeze_when_settled: Duration,
+    /// Desired frozen share, 0 disables the first-freeze coverage trigger.
+    pub frozen_coverage_target: f64,
+    /// Re-segment when frozen-fold bytes exceed this multiple of the last global cut.
+    pub resegment_when_frozen_folds_exceed: f64,
+    #[serde(with = "humantime_serde")]
+    pub lease_ttl: Duration,
+}
+
+impl Default for PacksConfig {
+    fn default() -> Self {
+        Self {
+            enabled: true,
+            geometric_factor: 2,
+            fold_when_fresh_packs_reach: 16,
+            fold_when_max_age: Duration::from_hours(24),
+            fold_needs_at_least_packs: 2,
+            segment_max_bytes: ByteSize::gib(2),
+            segment_target_bytes: ByteSize::b(0),
+            segment_delta_window: 250,
+            segment_delta_depth: 50,
+            segment_delta_window_memory: ByteSize::gib(2),
+            segment_reuse_objects: true,
+            segment_threads: 0,
+            freeze_when_settled: Duration::from_hours(14 * 24),
+            frozen_coverage_target: 0.75,
+            resegment_when_frozen_folds_exceed: 0.5,
+            lease_ttl: Duration::from_mins(10),
+        }
+    }
+}
+
+/// Counts for one compatible family. Frozen and other-family packs are excluded
+/// from fresh bytes/count; `live_bytes` is the repository's complete live inventory.
+#[derive(Debug, Clone, Default)]
+pub struct FoldInventory {
+    pub live_bytes: u64,
+    pub fresh_bytes: u64,
+    pub fresh_packs: usize,
+    pub oldest_fresh_age: Duration,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FoldReason {
+    Count,
+    Bytes,
+    Age,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FreezeReason {
+    Size,
+    Settled,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct DeltaBudget {
+    pub threads: usize,
+    pub window_memory_per_thread: u64,
+}
+
+impl PacksConfig {
+    pub fn validate(&self) -> Result<()> {
+        ensure!(
+            self.geometric_factor >= 2,
+            "packs.geometric_factor must be >= 2"
+        );
+        ensure!(
+            self.fold_needs_at_least_packs >= 2,
+            "packs.fold_needs_at_least_packs must be >= 2"
+        );
+        ensure!(
+            self.fold_when_fresh_packs_reach >= self.fold_needs_at_least_packs,
+            "packs.fold_when_fresh_packs_reach must reach the minimum useful count"
+        );
+        ensure!(
+            !self.enabled || self.segment_max_bytes.as_u64() >= ByteSize::mib(1).as_u64(),
+            "packs.segment_max_bytes must be >= 1 MiB when enabled"
+        );
+        let target = self.segment_target_bytes.as_u64();
+        ensure!(
+            target == 0
+                || (target >= ByteSize::mib(1).as_u64()
+                    && target <= self.segment_max_bytes.as_u64()),
+            "packs.segment_target_bytes must be zero or 1 MiB..=segment_max_bytes"
+        );
+        ensure!(
+            self.segment_delta_window > 0,
+            "packs.segment_delta_window must be positive"
+        );
+        ensure!(
+            self.segment_delta_depth > 0,
+            "packs.segment_delta_depth must be positive"
+        );
+        ensure!(
+            self.segment_delta_window_memory.as_u64() > 0,
+            "packs.segment_delta_window_memory must be positive (zero would be unbounded)"
+        );
+        ensure!(
+            self.frozen_coverage_target.is_finite()
+                && (0.0..=1.0).contains(&self.frozen_coverage_target),
+            "packs.frozen_coverage_target must be finite and within 0..=1"
+        );
+        ensure!(
+            self.resegment_when_frozen_folds_exceed.is_finite()
+                && self.resegment_when_frozen_folds_exceed > 0.0,
+            "packs.resegment_when_frozen_folds_exceed must be finite and positive"
+        );
+        ensure!(
+            !self.lease_ttl.is_zero(),
+            "packs.lease_ttl must be positive"
+        );
+        Ok(())
+    }
+
+    pub fn target_bytes(&self) -> u64 {
+        let target = self.segment_target_bytes.as_u64();
+        if target == 0 {
+            self.segment_max_bytes.as_u64()
+        } else {
+            target
+        }
+    }
+
+    /// A proportional byte trigger, floored by the useful URI threshold.
+    pub fn fold_byte_threshold(&self, live_bytes: u64, uri_min_bytes: u64) -> u64 {
+        let factor = u64::from(self.geometric_factor.max(2));
+        (live_bytes / (factor * factor)).max(uri_min_bytes)
+    }
+
+    pub fn fold_reason(&self, inventory: &FoldInventory, uri_min_bytes: u64) -> Option<FoldReason> {
+        if !self.enabled || inventory.fresh_packs < self.fold_needs_at_least_packs.max(2) {
+            return None;
+        }
+        if inventory.fresh_packs >= self.fold_when_fresh_packs_reach {
+            return Some(FoldReason::Count);
+        }
+        if inventory.fresh_bytes
+            >= self
+                .fold_byte_threshold(inventory.live_bytes, uri_min_bytes)
+                .max(1)
+        {
+            return Some(FoldReason::Bytes);
+        }
+        if !self.fold_when_max_age.is_zero() && inventory.oldest_fresh_age >= self.fold_when_max_age
+        {
+            return Some(FoldReason::Age);
+        }
+        None
+    }
+
+    /// A zero settlement duration disables the age arm; size remains independent.
+    pub fn freeze_reason(
+        &self,
+        fold_bytes: u64,
+        settled_for: Duration,
+        uri_min_bytes: u64,
+    ) -> Option<FreezeReason> {
+        if !self.enabled || fold_bytes == 0 {
+            return None;
+        }
+        if self.segment_max_bytes.as_u64() > 0 && fold_bytes >= self.segment_max_bytes.as_u64() {
+            return Some(FreezeReason::Size);
+        }
+        if fold_bytes >= uri_min_bytes.max(1)
+            && !self.freeze_when_settled.is_zero()
+            && settled_for >= self.freeze_when_settled
+        {
+            return Some(FreezeReason::Settled);
+        }
+        None
+    }
+
+    /// Resource planning only: approximate ratios never constitute a coverage proof.
+    #[expect(
+        clippy::cast_precision_loss,
+        reason = "Byte ratios schedule maintenance, not graph correctness"
+    )]
+    pub fn first_freeze_due(&self, live_bytes: u64, frozen_bytes: u64, uri_min_bytes: u64) -> bool {
+        self.enabled
+            && uri_min_bytes > 0
+            && live_bytes / 4 >= uri_min_bytes
+            && self.frozen_coverage_target > 0.0
+            && (frozen_bytes as f64) < self.frozen_coverage_target * live_bytes as f64
+    }
+
+    /// A missing global baseline belongs to first-freeze planning, not a zero denominator.
+    #[expect(
+        clippy::cast_precision_loss,
+        reason = "Byte ratios schedule maintenance, not graph correctness"
+    )]
+    pub fn resegment_due(&self, global_cut_bytes: u64, frozen_fold_bytes: u64) -> bool {
+        self.enabled
+            && global_cut_bytes > 0
+            && (frozen_fold_bytes as f64)
+                > self.resegment_when_frozen_folds_exceed * global_cut_bytes as f64
+    }
+
+    /// Resolve the whole-operation memory limit against host headroom and divide
+    /// across an explicit CPU-bounded thread count. Neither argument may be zero.
+    pub fn delta_budget(
+        &self,
+        available_threads: usize,
+        host_memory_limit: u64,
+    ) -> Result<DeltaBudget> {
+        ensure!(
+            available_threads > 0 && host_memory_limit > 0,
+            "pack delta search needs CPU and memory headroom"
+        );
+        let memory = self
+            .segment_delta_window_memory
+            .as_u64()
+            .min(host_memory_limit);
+        ensure!(
+            memory > 0,
+            "pack delta-search memory budget must be positive"
+        );
+        let threads = if self.segment_threads == 0 {
+            available_threads
+        } else {
+            self.segment_threads.min(available_threads)
+        };
+        let threads = threads.min(usize::try_from(memory).unwrap_or(usize::MAX));
+        let divisor = u64::try_from(threads)?;
+        Ok(DeltaBudget {
+            threads,
+            window_memory_per_thread: memory / divisor,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn defaults_validate_and_reject_obsolete_keys() {
+        let config = PacksConfig::default();
+        config.validate().unwrap();
+        assert_eq!(config.target_bytes(), 2_147_483_648);
+        for text in [
+            "factor = 2",
+            "trigger_bytes = \"1GiB\"",
+            "retention_superseded = \"7d\"",
+        ] {
+            assert!(toml::from_str::<PacksConfig>(text).is_err());
+        }
+        for text in [
+            "geometric_factor = 1",
+            "fold_needs_at_least_packs = 1",
+            "segment_max_bytes = \"100B\"",
+            "segment_delta_window_memory = \"0B\"",
+            "frozen_coverage_target = nan",
+            "frozen_coverage_target = 1.1",
+            "resegment_when_frozen_folds_exceed = inf",
+            "lease_ttl = \"0s\"",
+        ] {
+            assert!(
+                toml::from_str::<PacksConfig>(text)
+                    .unwrap()
+                    .validate()
+                    .is_err(),
+                "{text}"
+            );
+        }
+    }
+    #[test]
+    fn folds_need_two_inputs_and_have_independent_size_count_age_arms() {
+        let config = PacksConfig::default();
+        let floor = 32 * 1024 * 1024;
+        let mut inventory = FoldInventory {
+            live_bytes: floor * 16,
+            fresh_bytes: floor * 8,
+            fresh_packs: 1,
+            oldest_fresh_age: Duration::from_hours(48),
+        };
+        assert_eq!(config.fold_reason(&inventory, floor), None);
+        inventory.fresh_packs = 2;
+        assert_eq!(
+            config.fold_reason(&inventory, floor),
+            Some(FoldReason::Bytes)
+        );
+        inventory.fresh_bytes = 1;
+        assert_eq!(config.fold_reason(&inventory, floor), Some(FoldReason::Age));
+        inventory.oldest_fresh_age = Duration::ZERO;
+        assert_eq!(config.fold_reason(&inventory, floor), None);
+        inventory.fresh_packs = 16;
+        assert_eq!(
+            config.fold_reason(&inventory, floor),
+            Some(FoldReason::Count)
+        );
+        assert_eq!(config.fold_byte_threshold(floor, floor), floor);
+    }
+    #[test]
+    fn freeze_and_resegment_use_distinct_stability_triggers() {
+        let config = PacksConfig::default();
+        let floor = 32 * 1024 * 1024;
+        assert_eq!(
+            config.freeze_reason(floor - 1, Duration::from_hours(1000), floor),
+            None
+        );
+        assert_eq!(
+            config.freeze_reason(floor, Duration::from_hours(14 * 24), floor),
+            Some(FreezeReason::Settled)
+        );
+        assert_eq!(
+            config.freeze_reason(config.target_bytes(), Duration::ZERO, floor),
+            Some(FreezeReason::Size)
+        );
+        assert!(!config.first_freeze_due(floor * 3, 0, floor));
+        assert!(config.first_freeze_due(floor * 4, floor * 2, floor));
+        assert!(!config.first_freeze_due(floor * 4, floor * 3, floor));
+        assert!(!config.resegment_due(0, floor));
+        assert!(!config.resegment_due(floor * 2, floor));
+        assert!(config.resegment_due(floor * 2, floor + 1));
+    }
+    #[test]
+    fn thread_memory_budget_is_whole_operation_and_never_zero() {
+        let config = PacksConfig {
+            segment_threads: 128,
+            ..Default::default()
+        };
+        let budget = config.delta_budget(8, 1024).unwrap();
+        assert_eq!(
+            budget,
+            DeltaBudget {
+                threads: 8,
+                window_memory_per_thread: 128
+            }
+        );
+        let budget = config.delta_budget(8, 3).unwrap();
+        assert_eq!(
+            budget,
+            DeltaBudget {
+                threads: 3,
+                window_memory_per_thread: 1
+            }
+        );
+        assert!(config.delta_budget(0, 1024).is_err());
+        assert!(config.delta_budget(8, 0).is_err());
+    }
+}
diff --git a/crates/walgit-config/src/refs.rs b/crates/walgit-config/src/refs.rs
new file mode 100644
index 0000000..9a2c724
--- /dev/null
+++ b/crates/walgit-config/src/refs.rs
@@ -0,0 +1,319 @@
+//! Ref discovery and named object packaging policies. Neither grants access.
+use std::collections::{BTreeMap, BTreeSet};
+
+use anyhow::{Result, ensure};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PackGroupKind {
+    Code,
+    Meta,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct PackGroupConfig {
+    pub kind: PackGroupKind,
+    pub include: Vec<String>,
+    #[serde(default)]
+    pub subtract: Vec<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields, default)]
+pub struct RefsConfig {
+    pub advertise: Vec<String>,
+    pub packfiles: BTreeMap<String, PackGroupConfig>,
+}
+
+impl Default for RefsConfig {
+    fn default() -> Self {
+        Self {
+            advertise: vec!["refs/heads/*".into(), "refs/tags/*".into()],
+            packfiles: BTreeMap::from([
+                (
+                    "code".into(),
+                    PackGroupConfig {
+                        kind: PackGroupKind::Code,
+                        include: vec!["refs/*".into()],
+                        subtract: vec![],
+                    },
+                ),
+                (
+                    "meta".into(),
+                    PackGroupConfig {
+                        kind: PackGroupKind::Meta,
+                        include: vec!["refs/meta".into(), "refs/meta/*".into()],
+                        subtract: vec![],
+                    },
+                ),
+            ]),
+        }
+    }
+}
+
+pub fn is_metadata_ref(name: &str) -> bool {
+    name == "refs/meta" || name.starts_with("refs/meta/")
+}
+
+#[expect(
+    clippy::case_sensitive_file_extension_comparisons,
+    reason = "Git refname rules reject the case-sensitive .lock suffix"
+)]
+fn valid_ref(name: &str) -> bool {
+    name.starts_with("refs/")
+        && !name.ends_with('/')
+        && !name.ends_with('.')
+        && !name.contains("..")
+        && !name.contains("@{")
+        && !name
+            .bytes()
+            .any(|b| b <= b' ' || b == 127 || b"~^:?*[\\".contains(&b))
+        && name
+            .split('/')
+            .all(|p| !p.is_empty() && !p.starts_with('.') && !p.ends_with(".lock"))
+}
+
+fn validate_selectors(selectors: &[String]) -> Result<()> {
+    ensure!(selectors.len() <= 256, "at most 256 ref selectors per list");
+    for selector in selectors {
+        let pattern = selector.strip_prefix('!').unwrap_or(selector);
+        let valid = if pattern == "HEAD" {
+            true
+        } else if let Some(prefix) = pattern.strip_suffix('*') {
+            // Complete the trailing byte prefix into a syntactically valid ref.
+            valid_ref(&format!("{prefix}x"))
+        } else {
+            valid_ref(pattern)
+        };
+        ensure!(valid, "invalid ref selector {selector:?}");
+    }
+    Ok(())
+}
+
+/// Match a validated selector's positive pattern. HEAD uses the captured symbolic target.
+pub fn selector_matches(pattern: &str, name: &str, head_target: &str) -> bool {
+    if pattern == "HEAD" {
+        return !head_target.is_empty() && name == head_target;
+    }
+    pattern
+        .strip_suffix('*')
+        .map_or(name == pattern, |p| name.starts_with(p))
+}
+
+/// Ordered exclusions, last matching selector wins. No match means excluded.
+pub fn selectors_match(selectors: &[String], name: &str, head_target: &str) -> bool {
+    let mut included = false;
+    for selector in selectors {
+        let (negative, pattern) = selector
+            .strip_prefix('!')
+            .map_or((false, selector.as_str()), |s| (true, s));
+        if selector_matches(pattern, name, head_target) {
+            included = !negative;
+        }
+    }
+    included
+}
+
+impl PackGroupConfig {
+    pub fn matches_ref(&self, name: &str, head_target: &str) -> bool {
+        (is_metadata_ref(name) == (self.kind == PackGroupKind::Meta))
+            && selectors_match(&self.include, name, head_target)
+    }
+}
+
+impl RefsConfig {
+    pub fn validate(&self) -> Result<()> {
+        fn visit<'a>(
+            name: &'a str,
+            groups: &'a BTreeMap<String, PackGroupConfig>,
+            visiting: &mut BTreeSet<&'a str>,
+            done: &mut BTreeSet<&'a str>,
+        ) -> Result<()> {
+            if done.contains(name) {
+                return Ok(());
+            }
+            ensure!(
+                visiting.insert(name),
+                "pack group dependency cycle at {name}"
+            );
+            if let Some(group) = groups.get(name) {
+                for dep in &group.subtract {
+                    visit(dep, groups, visiting, done)?;
+                }
+            }
+            visiting.remove(name);
+            done.insert(name);
+            Ok(())
+        }
+
+        ensure!(self.packfiles.len() <= 32, "at most 32 pack groups");
+        validate_selectors(&self.advertise)?;
+        let mut bytes = self.advertise.iter().map(String::len).sum::<usize>();
+        for (name, group) in &self.packfiles {
+            ensure!(
+                !name.is_empty()
+                    && !name.starts_with('_')
+                    && name
+                        .bytes()
+                        .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_'),
+                "invalid pack group name {name:?}"
+            );
+            validate_selectors(&group.include)?;
+            ensure!(
+                group.subtract.len() <= 32,
+                "too many dependencies for group {name}"
+            );
+            let unique: BTreeSet<_> = group.subtract.iter().collect();
+            ensure!(
+                unique.len() == group.subtract.len(),
+                "duplicate dependencies for group {name}"
+            );
+            bytes += name.len()
+                + group.include.iter().map(String::len).sum::<usize>()
+                + group.subtract.iter().map(String::len).sum::<usize>();
+            for dep in &group.subtract {
+                let target = self
+                    .packfiles
+                    .get(dep)
+                    .ok_or_else(|| anyhow::anyhow!("unknown dependency {dep} for group {name}"))?;
+                ensure!(
+                    group.kind == PackGroupKind::Code && target.kind == PackGroupKind::Code,
+                    "subtraction is permitted only between code groups"
+                );
+            }
+        }
+        ensure!(bytes <= 16 * 1024, "ref policy exceeds 16 KiB");
+        let mut done = BTreeSet::new();
+        for name in self.packfiles.keys() {
+            visit(name, &self.packfiles, &mut BTreeSet::new(), &mut done)?;
+        }
+        Ok(())
+    }
+
+    /// Stable length-framed group policy hash. Advertisement is intentionally excluded.
+    pub fn policy_identity(&self) -> String {
+        fn field(hash: &mut Sha256, value: &[u8]) {
+            hash.update((value.len() as u64).to_be_bytes());
+            hash.update(value);
+        }
+        let mut hash = Sha256::new();
+        hash.update(b"walgit-pack-policy-v1\0");
+        hash.update((self.packfiles.len() as u64).to_be_bytes());
+        for (name, group) in &self.packfiles {
+            field(&mut hash, name.as_bytes());
+            field(
+                &mut hash,
+                match group.kind {
+                    PackGroupKind::Code => b"code",
+                    PackGroupKind::Meta => b"meta",
+                },
+            );
+            hash.update((group.include.len() as u64).to_be_bytes());
+            for selector in &group.include {
+                field(&mut hash, selector.as_bytes());
+            }
+            let deps: BTreeSet<_> = group.subtract.iter().collect();
+            hash.update((deps.len() as u64).to_be_bytes());
+            for dep in deps {
+                field(&mut hash, dep.as_bytes());
+            }
+        }
+        hex::encode(hash.finalize())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn selection_keeps_metadata_separate_and_resolves_head() {
+        let cfg = RefsConfig::default();
+        cfg.validate().unwrap();
+        assert!(cfg.packfiles["code"].matches_ref("refs/heads/topic", "refs/heads/main"));
+        assert!(!cfg.packfiles["code"].matches_ref("refs/meta/main", "refs/heads/main"));
+        assert!(cfg.packfiles["meta"].matches_ref("refs/meta/main", "refs/heads/main"));
+        let selectors = ["refs/*", "!refs/heads/*", "HEAD"].map(str::to_owned);
+        assert!(selectors_match(
+            &selectors,
+            "refs/heads/trunk",
+            "refs/heads/trunk"
+        ));
+        assert!(!selectors_match(
+            &selectors,
+            "refs/heads/main",
+            "refs/heads/trunk"
+        ));
+    }
+    #[test]
+    fn policy_identity_ignores_discovery_but_tracks_packaging() {
+        let mut cfg = RefsConfig::default();
+        let id = cfg.policy_identity();
+        cfg.advertise = vec!["HEAD".into()];
+        assert_eq!(id, cfg.policy_identity());
+        cfg.packfiles.get_mut("code").unwrap().include = vec!["HEAD".into()];
+        assert_ne!(id, cfg.policy_identity());
+    }
+    #[test]
+    fn invalid_selectors_dependencies_cycles_and_limits_fail() {
+        for bad in [
+            "*",
+            "refs/**",
+            "refs/a?",
+            "refs/a..b",
+            "refs/.hidden",
+            "refs/a.lock",
+            "!",
+            "refs//x",
+            "refs/x@{a",
+        ] {
+            let cfg = RefsConfig {
+                advertise: vec![bad.into()],
+                ..Default::default()
+            };
+            assert!(cfg.validate().is_err(), "{bad}");
+        }
+        let mut cfg = RefsConfig::default();
+        cfg.packfiles.get_mut("code").unwrap().subtract = vec!["meta".into()];
+        assert!(cfg.validate().is_err());
+        cfg.packfiles.get_mut("code").unwrap().subtract = vec!["missing".into()];
+        assert!(cfg.validate().is_err());
+        cfg.packfiles.get_mut("code").unwrap().subtract = vec!["code".into()];
+        assert!(cfg.validate().is_err());
+        let cfg = RefsConfig {
+            advertise: vec!["HEAD".into(); 257],
+            ..Default::default()
+        };
+        assert!(cfg.validate().is_err());
+    }
+}
+
+#[cfg(test)]
+mod config_tests {
+    use crate::Config;
+    #[test]
+    fn settings_merge_group_fields_and_require_new_group_definitions() {
+        let base = Config::default();
+        let effective=base.with_settings("[refs.packfiles.code]\ninclude = [\"HEAD\"]\n[packfile_uri]\nmax_uris_per_fetch = 8\n").unwrap();
+        assert_eq!(effective.refs.packfiles["code"].include, ["HEAD"]);
+        assert_eq!(
+            effective.refs.packfiles["code"].kind,
+            super::PackGroupKind::Code
+        );
+        assert!(effective.refs.packfiles.contains_key("meta"));
+        assert_eq!(effective.packfile_uri.max_uris_per_fetch, 8);
+        for text in [
+            "[refs.packfiles.new]\ninclude = []",
+            "[refs.packfiles.new]\nkind = \"code\"",
+            "[refs]\nunknown = true",
+            "[packfile_uri]\nunknown = true",
+            "[packfile_uri]\nmax_uris_per_fetch = 0",
+        ] {
+            assert!(base.with_settings(text).is_err(), "{text}");
+        }
+        let effective=base.with_settings("[refs.packfiles.extra]\nkind = \"code\"\ninclude = [\"refs/heads/*\"]\nsubtract = [\"code\"]").unwrap();
+        assert_eq!(effective.refs.packfiles.len(), 3);
+    }
+}
diff --git a/crates/walgit-git/src/lib.rs b/crates/walgit-git/src/lib.rs
index 1d277ef..d1ce0ce 100644
--- a/crates/walgit-git/src/lib.rs
+++ b/crates/walgit-git/src/lib.rs
@@ -1,9 +1,15 @@
 //! Local git repository engine: gix in-process for odb/refs/revwalk/pack
 //! generation; upstream git subprocess for ingest (`index-pack`), repack,
-//! bundle, and the selectable `Engine::Git` upload-pack fallback. See AGENTS.md
+//! and the selectable `Engine::Git` upload-pack fallback. See AGENTS.md
 //! D2 and docs/CONTRACT.md walgit-git.
 
 pub mod follow;
+pub mod maintenance_input;
+pub mod midx;
+pub mod object_links;
+pub mod pack_groups;
+pub mod pack_segments;
+pub mod packfile_uri;
 pub mod pkt;
 pub mod receive;
 pub mod repair;
@@ -424,7 +430,7 @@ impl Service {
     }
 }
 
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, Default)]
 #[expect(
     clippy::struct_excessive_bools,
     reason = "Independent Git protocol capabilities and request flags"
@@ -446,6 +452,7 @@ pub struct UploadPackRequest {
     pub shallow: Vec<gix_hash::ObjectId>,
     pub want_refs: Vec<String>,
     pub packfile_uris_protocols: Vec<String>,
+    pub packfile_indexes: bool,
 }
 
 #[derive(Debug, Clone, Default)]
@@ -474,12 +481,6 @@ pub struct RepackResult {
     pub removed: Vec<gix_hash::ObjectId>,
 }
 
-#[derive(Debug, Clone)]
-pub struct BundleInfo {
-    pub size: u64,
-    pub pack_offset: u64,
-}
-
 /// Outcome of [`LocalRepo::fsck_streaming`].
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct FsckReport {
@@ -563,6 +564,8 @@ struct Inner {
     refs_gen: std::sync::atomic::AtomicU64,
     /// How often `packed-refs` + loose refs were parsed (tests assert pushes do not add to it).
     refs_parses: std::sync::atomic::AtomicU64,
+    /// Disposable serving mode selected from the committed manifest by sync.
+    segmented_midx: std::sync::atomic::AtomicBool,
 }
 
 #[derive(Clone)]
@@ -653,6 +656,7 @@ impl LocalRepo {
                 refs_cache: parking_lot::Mutex::new(None),
                 refs_gen: std::sync::atomic::AtomicU64::new(0),
                 refs_parses: std::sync::atomic::AtomicU64::new(0),
+                segmented_midx: std::sync::atomic::AtomicBool::new(false),
             }),
         })
     }
@@ -678,6 +682,7 @@ impl LocalRepo {
                 refs_cache: parking_lot::Mutex::new(None),
                 refs_gen: std::sync::atomic::AtomicU64::new(0),
                 refs_parses: std::sync::atomic::AtomicU64::new(0),
+                segmented_midx: std::sync::atomic::AtomicBool::new(false),
             }),
         }))
     }
@@ -969,6 +974,13 @@ impl LocalRepo {
         let hex = checksum.to_hex();
         let pack_dir = self.objects_pack_dir();
         let was_history = pack_dir.join(format!("pack-{hex}.history")).exists();
+        if self
+            .inner
+            .segmented_midx
+            .load(std::sync::atomic::Ordering::Acquire)
+        {
+            self.invalidate_midx()?;
+        }
         for ext in ["pack", "idx", "rev", "bitmap", "commit-graph", "history"] {
             let p = pack_dir.join(format!("pack-{hex}.{ext}"));
             match std::fs::remove_file(&p) {
@@ -1916,8 +1928,20 @@ impl LocalRepo {
 
     /// v0 advertisement with capabilities. The HTTP server prepends the
     /// `# service=<svc>\n` pkt-line + flush.
-    pub fn advertise_refs_v0(&self, service: Service, out: &mut Vec<u8>) -> Result<(), GitError> {
-        let snap = self.refs()?;
+    pub fn advertise_refs_v0(
+        &self,
+        service: Service,
+        out: &mut Vec<u8>,
+        selectors: Option<&[String]>,
+    ) -> Result<(), GitError> {
+        let mut snap = self.refs()?;
+        if service == Service::UploadPack
+            && let Some(selectors) = selectors
+        {
+            snap.refs.retain(|r| {
+                walgit_config::refs::selectors_match(selectors, &r.name, &snap.head_target)
+            });
+        }
         let caps = capabilities_for(service, self.inner.format);
         let caps_line = format!("\0{caps}\n");
 
@@ -2243,6 +2267,13 @@ impl LocalRepo {
     }
 
     fn write_history_midx_blocking(&self) -> Result<(), GitError> {
+        if self
+            .inner
+            .segmented_midx
+            .load(std::sync::atomic::Ordering::Acquire)
+        {
+            return Ok(());
+        }
         // The midx covers the history pack(s) **and their bases** (when the
         // base idx is installed: linked or local), history first as the
         // preferred pack: an object in both resolves to the history pack, and
@@ -2456,43 +2487,6 @@ impl LocalRepo {
         Ok(())
     }
 
-    pub async fn write_bundle(
-        &self,
-        out: &Path,
-        refs: &[String],
-        exclude: &[gix_hash::ObjectId],
-    ) -> Result<BundleInfo, GitError> {
-        // Build rev args fed to `git bundle create <out> --stdin`.
-        let mut input = String::new();
-        for r in refs {
-            input.push_str(r);
-            input.push('\n');
-        }
-        for e in exclude {
-            input.push('^');
-            input.push_str(&e.to_hex().to_string());
-            input.push('\n');
-        }
-        let out_str = out.to_string_lossy().to_string();
-        let bundle_out = self
-            .run_git_stdin(
-                "bundle",
-                &["create", out_str.as_str(), "--stdin"],
-                input.as_bytes(),
-            )
-            .await?;
-        if !bundle_out.status.success() {
-            return Err(GitError::Subprocess {
-                cmd: "git bundle create".into(),
-                status: bundle_out.status.code(),
-                stderr: String::from_utf8_lossy(&bundle_out.stderr).into_owned(),
-            });
-        }
-        let size = std::fs::metadata(out).map_or(0, |m| m.len());
-        let pack_offset = locate_pack_offset(out).unwrap_or(size);
-        Ok(BundleInfo { size, pack_offset })
-    }
-
     /// Full `git fsck` of the local copy, streaming every output line (stdout
     /// and stderr, interleaved by arrival) to `on_line`. `connectivity_only`
     /// skips object content checks (much faster on big repos). Returns the
@@ -2708,30 +2702,6 @@ impl LocalRepo {
 // Free functions
 // ---------------------------------------------------------------------------
 
-/// Render a git bundle v2 header from a ref snapshot and prerequisites, so a
-/// full bundle can be assembled as header + existing pack bytes without git.
-pub fn bundle_header(
-    refs: &RefSnapshotData,
-    prerequisites: &[gix_hash::ObjectId],
-    format: ObjectFormat,
-) -> Vec<u8> {
-    let mut out = Vec::new();
-    out.extend_from_slice(b"# v2 git bundle\n");
-    for p in prerequisites {
-        out.extend_from_slice(p.to_hex().to_string().as_bytes());
-        out.extend_from_slice(b" \n");
-    }
-    for r in &refs.refs {
-        out.extend_from_slice(r.oid.as_bytes());
-        out.push(b' ');
-        out.extend_from_slice(r.name.as_bytes());
-        out.push(b'\n');
-    }
-    out.push(b'\n');
-    let _ = format;
-    out
-}
-
 // ---------------------------------------------------------------------------
 // Internals
 // ---------------------------------------------------------------------------
@@ -3177,6 +3147,15 @@ fn peel_tag(repo: &gix::Repository, oid: gix_hash::ObjectId) -> Option<gix_hash:
 pub fn build_v2_fetch_request(req: &UploadPackRequest) -> Vec<u8> {
     let mut buf = Vec::new();
     pkt::encode_data(&mut buf, b"command=fetch\n");
+    if req
+        .wants
+        .first()
+        .or(req.haves.first())
+        .or(req.shallow.first())
+        .is_some_and(|oid| oid.kind() == gix_hash::Kind::Sha256)
+    {
+        pkt::encode_data(&mut buf, b"object-format=sha256\n");
+    }
     // Git protocol v2 carries all fetch features (thin-pack, want, have, ...)
     // as arguments following the delim-pkt; there is no pre-delim capability
     // section for fetch.
@@ -3224,7 +3203,7 @@ pub fn build_v2_fetch_request(req: &UploadPackRequest) -> Vec<u8> {
         pkt::encode_data(&mut buf, format!("want-ref {r}\n").as_bytes());
     }
     if !req.packfile_uris_protocols.is_empty() {
-        let joined = req.packfile_uris_protocols.join(" ");
+        let joined = req.packfile_uris_protocols.join(",");
         pkt::encode_data(&mut buf, format!("packfile-uris {joined}\n").as_bytes());
     }
     if req.done {
@@ -3234,33 +3213,6 @@ pub fn build_v2_fetch_request(req: &UploadPackRequest) -> Vec<u8> {
     buf
 }
 
-fn find_subsequence(haystack: &[u8], needle: &[u8]) -> Option<usize> {
-    haystack.windows(needle.len()).position(|w| w == needle)
-}
-
-fn locate_pack_offset(path: &Path) -> Option<u64> {
-    use std::io::{Read, Seek, SeekFrom};
-    let mut f = std::fs::File::open(path).ok()?;
-    // The pack payload starts with the literal "PACK". Scan the file head.
-    let mut buf = vec![0u8; 8 * 1024];
-    let mut pos = 0u64;
-    loop {
-        let n = f.read(&mut buf).ok()?;
-        if n == 0 {
-            return None;
-        }
-        if let Some(i) = find_subsequence(buf.get(..n)?, b"PACK") {
-            return Some(pos + i as u64);
-        }
-        // Seek back a little to handle boundary splits.
-        if n < buf.len() {
-            return None;
-        }
-        pos += n as u64 - 3;
-        f.seek(SeekFrom::Start(pos)).ok()?;
-    }
-}
-
 // ---------------------------------------------------------------------------
 // gix upload-pack helpers
 // ---------------------------------------------------------------------------
diff --git a/crates/walgit-git/src/maintenance_input.rs b/crates/walgit-git/src/maintenance_input.rs
new file mode 100644
index 0000000..6b0b235
--- /dev/null
+++ b/crates/walgit-git/src/maintenance_input.rs
@@ -0,0 +1,434 @@
+//! Attempt-owned maintenance repositories containing only captured committed inputs.
+//!
+//! Callers supply an owned reader pin covering the source files. It is moved into
+//! the blocking task, so cancellation cannot release it while files are copied.
+use std::collections::HashSet;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+use std::sync::atomic::AtomicBool;
+
+use walgit_proto::v1::{PackRef, RefSnapshot};
+
+use crate::{GitError, LocalRepo, ObjectFormat, RepoId, ge};
+
+pub struct MaintenanceInput {
+    pub repo: LocalRepo,
+    pub packs: Vec<PackRef>,
+    pub refs: RefSnapshot,
+    // Drop the repository handles before removing its attempt directory.
+    attempt_dir: Option<tempfile::TempDir>,
+    root: PathBuf,
+    lock: std::fs::File,
+}
+
+impl Drop for MaintenanceInput {
+    fn drop(&mut self) {
+        // Explicit unlock also releases transient fork-inherited descriptors;
+        // correctness must not wait for another thread's child to reach exec.
+        let _ = self.lock.unlock();
+    }
+}
+
+impl MaintenanceInput {
+    /// Opt into reusable scratch. The caller owns cleanup; this is never durable
+    /// repository state and may be deleted to restart from committed inputs.
+    pub fn persist(&mut self) -> PathBuf {
+        if let Some(attempt) = self.attempt_dir.take() {
+            let _ = attempt.keep();
+        }
+        self.root.clone()
+    }
+    pub fn scratch_root(&self) -> &Path {
+        &self.root
+    }
+}
+
+/// Reopen disposable scratch only against caller-supplied captured authority.
+/// Revalidates original pack bytes and rejects injected objects/alternates.
+pub async fn reopen(
+    root: PathBuf,
+    packs: Vec<PackRef>,
+    refs: RefSnapshot,
+) -> Result<MaintenanceInput, GitError> {
+    tokio::task::spawn_blocking(move || {
+        let lock = lock_attempt(&root)?;
+        walgit_proto::snapshot::validate(&refs)
+            .map_err(|e| GitError::InvalidInput(e.to_string()))?;
+        let repo = LocalRepo::open(&root, &RepoId::new("maintenance", "input")?)?
+            .ok_or_else(|| GitError::InvalidInput("missing maintenance input".into()))?;
+        if repo.object_format().as_str() != refs.object_format {
+            return Err(GitError::InvalidInput(
+                "scratch object format mismatch".into(),
+            ));
+        }
+        let mut expected = HashSet::new();
+        for pack in &packs {
+            let oid = gix_hash::ObjectId::from_hex(pack.checksum.as_bytes()).map_err(ge)?;
+            if oid.kind() != repo.object_format().kind() || oid.to_string() != pack.checksum {
+                return Err(GitError::InvalidInput(
+                    "invalid scratch pack checksum".into(),
+                ));
+            }
+            for (ext, required) in [
+                ("pack", true),
+                ("idx", true),
+                ("rev", pack.has_rev),
+                ("bitmap", pack.has_bitmap),
+                ("commit-graph", pack.has_commit_graph),
+            ] {
+                if required && !expected.insert(format!("pack-{}.{ext}", pack.checksum)) {
+                    return Err(GitError::InvalidInput("duplicate scratch pack".into()));
+                }
+            }
+            verify(&repo, pack, repo.object_format())?;
+        }
+        let objects = repo.path().join("objects");
+        for entry in std::fs::read_dir(&objects)? {
+            let entry = entry?;
+            if entry.file_name() != "pack" && entry.file_name() != "info" {
+                return Err(GitError::InvalidInput(
+                    "unexpected loose scratch objects".into(),
+                ));
+            }
+        }
+        for entry in std::fs::read_dir(objects.join("pack"))? {
+            let entry = entry?;
+            if !entry.file_type()?.is_file()
+                || !expected.remove(&entry.file_name().to_string_lossy().into_owned())
+            {
+                return Err(GitError::InvalidInput(
+                    "unexpected scratch pack file".into(),
+                ));
+            }
+        }
+        if !expected.is_empty() || std::fs::read_dir(objects.join("info"))?.next().is_some() {
+            return Err(GitError::InvalidInput(
+                "incomplete scratch files or unexpected object info".into(),
+            ));
+        }
+        repo.load_ref_snapshot(&refs)?;
+        repo.refresh()?;
+        Ok(MaintenanceInput {
+            repo,
+            packs,
+            refs,
+            root,
+            attempt_dir: None,
+            lock,
+        })
+    })
+    .await
+    .map_err(ge)?
+}
+
+fn lock_attempt(root: &Path) -> Result<std::fs::File, GitError> {
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .write(true)
+        .create(true)
+        .truncate(false)
+        .open(root.join(".lock"))?;
+    file.try_lock()
+        .map_err(|e| GitError::InvalidInput(format!("maintenance attempt is busy: {e}")))?;
+    Ok(file)
+}
+
+/// Build and verify an isolated input ODB on a blocking worker. `source` is the
+/// bare repository directory. No loose objects, alternates, MIDX, or uncommitted
+/// packs from that directory enter the attempt. Scratch is disposable progress.
+pub async fn prepare<P: Send + 'static>(
+    source: PathBuf,
+    scratch_parent: PathBuf,
+    packs: Vec<PackRef>,
+    refs: RefSnapshot,
+    reader_pin: P,
+) -> Result<MaintenanceInput, GitError> {
+    tokio::task::spawn_blocking(move || {
+        let _pin = reader_pin;
+        prepare_blocking(&source, &scratch_parent, packs, refs)
+    })
+    .await
+    .map_err(ge)?
+}
+
+fn prepare_blocking(
+    source: &Path,
+    scratch_parent: &Path,
+    packs: Vec<PackRef>,
+    refs: RefSnapshot,
+) -> Result<MaintenanceInput, GitError> {
+    walgit_proto::snapshot::validate(&refs).map_err(|e| GitError::InvalidInput(e.to_string()))?;
+    let format = match refs.object_format.as_str() {
+        "sha1" => ObjectFormat::Sha1,
+        "sha256" => ObjectFormat::Sha256,
+        _ => unreachable!("validated snapshot"),
+    };
+    let mut seen = HashSet::new();
+    for pack in &packs {
+        if pack.checksum.len() != format.kind().len_in_hex()
+            || !pack
+                .checksum
+                .bytes()
+                .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+            || !seen.insert(&pack.checksum)
+        {
+            return Err(GitError::InvalidInput(
+                "invalid or duplicate committed pack checksum".into(),
+            ));
+        }
+    }
+    std::fs::create_dir_all(scratch_parent)?;
+    let attempt = tempfile::Builder::new()
+        .prefix("maintenance-input-")
+        .tempdir_in(scratch_parent)?;
+    let lock = lock_attempt(attempt.path())?;
+    let repo = LocalRepo::init(
+        attempt.path(),
+        &RepoId::new("maintenance", "input")?,
+        format,
+    )?;
+    for descriptor in &packs {
+        let name = format!("pack-{}", descriptor.checksum);
+        for (ext, required) in [
+            ("pack", true),
+            ("idx", true),
+            ("rev", descriptor.has_rev),
+            ("bitmap", descriptor.has_bitmap),
+            ("commit-graph", descriptor.has_commit_graph),
+        ] {
+            if !required {
+                continue;
+            }
+            let from = source.join("objects/pack").join(format!("{name}.{ext}"));
+            // Copy, rather than hard-link, so subsequent scratch tools cannot
+            // mutate serving inodes, including side files.
+            if !std::fs::metadata(&from)?.is_file() {
+                return Err(GitError::InvalidInput(
+                    "committed input is not a file".into(),
+                ));
+            }
+            std::fs::copy(
+                from,
+                repo.path()
+                    .join("objects/pack")
+                    .join(format!("{name}.{ext}")),
+            )?;
+        }
+        verify(&repo, descriptor, format)?;
+    }
+    repo.load_ref_snapshot(&refs)?;
+    repo.refresh()?;
+    Ok(MaintenanceInput {
+        repo,
+        packs,
+        refs,
+        root: attempt.path().to_path_buf(),
+        attempt_dir: Some(attempt),
+        lock,
+    })
+}
+
+pub(crate) fn verify(
+    repo: &LocalRepo,
+    expected: &PackRef,
+    format: ObjectFormat,
+) -> Result<(), GitError> {
+    let path = repo
+        .path()
+        .join("objects/pack")
+        .join(format!("pack-{}.pack", expected.checksum));
+    let idx_path = path.with_extension("idx");
+    if std::fs::metadata(&path)?.len() != expected.pack_size
+        || std::fs::metadata(&idx_path)?.len() != expected.idx_size
+    {
+        return Err(GitError::InvalidInput(
+            "committed pack/index size mismatch".into(),
+        ));
+    }
+    let index = gix_pack::index::File::at(&idx_path, format.kind()).map_err(ge)?;
+    let pack = gix_pack::data::File::at(&path, format.kind()).map_err(ge)?;
+    let stop = AtomicBool::new(false);
+    let mut progress = gix_features::progress::Discard;
+    index.verify_checksum(&mut progress, &stop).map_err(ge)?;
+    let actual = pack.verify_checksum(&mut progress, &stop).map_err(ge)?;
+    if actual.to_string() != expected.checksum
+        || index.pack_checksum() != actual
+        || u64::from(index.num_objects()) != expected.object_count
+        || index.num_objects() != pack.num_objects()
+    {
+        return Err(GitError::InvalidInput(
+            "committed pack/index inventory mismatch".into(),
+        ));
+    }
+    // Git verifies every index entry against the decoded object, including CRCs
+    // and delta dependencies. No verbose object inventory is collected in RAM.
+    let output = Command::new("git")
+        .arg("-C")
+        .arg(repo.path())
+        .args(["verify-pack"])
+        .arg(&idx_path)
+        .stdout(Stdio::null())
+        .output()?;
+    if !output.status.success() {
+        return Err(GitError::Subprocess {
+            cmd: "git verify-pack".into(),
+            status: output.status.code(),
+            stderr: String::from_utf8_lossy(&output.stderr).into_owned(),
+        });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    fn git(repo: &LocalRepo, args: &[&str], input: &str) -> String {
+        let mut child = Command::new("git")
+            .arg("-C")
+            .arg(repo.path())
+            .args(args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        child
+            .stdin
+            .take()
+            .unwrap()
+            .write_all(input.as_bytes())
+            .unwrap();
+        let out = child.wait_with_output().unwrap();
+        assert!(
+            out.status.success(),
+            "{}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+        String::from_utf8(out.stdout).unwrap().trim().to_owned()
+    }
+
+    fn add_pack(repo: &LocalRepo, text: &str) -> (PackRef, String) {
+        let oid = git(repo, &["hash-object", "-w", "--stdin"], text);
+        let prefix = repo.path().join("objects/pack/pack");
+        let checksum = git(
+            repo,
+            &["pack-objects", prefix.to_str().unwrap()],
+            &format!("{oid}\n"),
+        );
+        let path = prefix.with_file_name(format!("pack-{checksum}.pack"));
+        (
+            PackRef {
+                checksum,
+                pack_size: std::fs::metadata(&path).unwrap().len(),
+                idx_size: std::fs::metadata(path.with_extension("idx")).unwrap().len(),
+                object_count: 1,
+                ..Default::default()
+            },
+            oid,
+        )
+    }
+
+    #[tokio::test]
+    async fn exact_inventory_conserves_unreachable_objects_and_excludes_uncommitted_inputs() {
+        for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+            let root = tempfile::tempdir().unwrap();
+            let source =
+                LocalRepo::init(root.path(), &RepoId::new("test", "source").unwrap(), format)
+                    .unwrap();
+            let (committed, oid) = add_pack(&source, "committed unreachable blob");
+            let (extra, _) = add_pack(&source, "uncommitted blob");
+            let snap = RefSnapshot {
+                object_format: format.as_str().into(),
+                head_target: "refs/heads/main".into(),
+                ..Default::default()
+            };
+            let input = prepare(
+                source.path().to_path_buf(),
+                root.path().join("scratch"),
+                vec![committed.clone()],
+                snap.clone(),
+                (),
+            )
+            .await
+            .unwrap();
+            assert_eq!(input.packs, vec![committed]);
+            assert_eq!(input.refs, snap);
+            assert_eq!(
+                git(&input.repo, &["cat-file", "blob", &oid], ""),
+                "committed unreachable blob"
+            );
+            let pack_dir = input.repo.path().join("objects/pack");
+            assert_eq!(std::fs::read_dir(&pack_dir).unwrap().count(), 2);
+            assert!(
+                !pack_dir
+                    .join(format!("pack-{}.pack", extra.checksum))
+                    .exists()
+            );
+            assert!(!input.repo.path().join("objects/info/alternates").exists());
+            let path = input.repo.path().to_path_buf();
+            drop(input);
+            assert!(!path.exists());
+            assert!(source.path().exists());
+        }
+    }
+
+    #[tokio::test]
+    async fn missing_corrupt_or_mismatched_committed_inputs_fail_closed() {
+        let root = tempfile::tempdir().unwrap();
+        let source = LocalRepo::init(
+            root.path(),
+            &RepoId::new("test", "source").unwrap(),
+            ObjectFormat::Sha1,
+        )
+        .unwrap();
+        let (pack, _) = add_pack(&source, "committed blob");
+        let snapshot = RefSnapshot {
+            object_format: "sha1".into(),
+            ..Default::default()
+        };
+        let mut cases = Vec::new();
+        let mut bad = pack.clone();
+        bad.checksum = "../escape".into();
+        cases.push(bad);
+        let mut bad = pack.clone();
+        bad.object_count += 1;
+        cases.push(bad);
+        let mut bad = pack.clone();
+        bad.has_bitmap = true;
+        cases.push(bad);
+        for bad in cases {
+            assert!(
+                prepare(
+                    source.path().to_path_buf(),
+                    root.path().join("scratch"),
+                    vec![bad],
+                    snapshot.clone(),
+                    ()
+                )
+                .await
+                .is_err()
+            );
+        }
+        let path = source
+            .path()
+            .join("objects/pack")
+            .join(format!("pack-{}.pack", pack.checksum));
+        let mut bytes = std::fs::read(&path).unwrap();
+        bytes[12] ^= 1;
+        std::fs::remove_file(&path).unwrap();
+        std::fs::write(path, bytes).unwrap();
+        assert!(
+            prepare(
+                source.path().to_path_buf(),
+                root.path().join("scratch"),
+                vec![pack],
+                snapshot,
+                ()
+            )
+            .await
+            .is_err()
+        );
+    }
+}
diff --git a/crates/walgit-git/src/midx.rs b/crates/walgit-git/src/midx.rs
new file mode 100644
index 0000000..4a55580
--- /dev/null
+++ b/crates/walgit-git/src/midx.rs
@@ -0,0 +1,216 @@
+//! Verified multi-pack bitmaps for a complete installed pack inventory.
+use std::io::{Read, Seek, SeekFrom, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Command, Stdio};
+
+use crate::{GitError, LocalRepo, ObjectId, ge};
+
+#[derive(Debug)]
+pub struct VerifiedMidx {
+    pub checksum: ObjectId,
+    pub bitmap_path: PathBuf,
+}
+
+fn checked(command: &mut Command, input: Option<&[u8]>) -> Result<(), GitError> {
+    let description = format!("{command:?}");
+    let mut child = command
+        .stdin(Stdio::piped())
+        .stdout(Stdio::null())
+        .stderr(Stdio::piped())
+        .spawn()?;
+    if let Some(input) = input {
+        child
+            .stdin
+            .take()
+            .ok_or_else(|| std::io::Error::other("missing git stdin"))?
+            .write_all(input)?;
+    } else {
+        drop(child.stdin.take());
+    }
+    let output = child.wait_with_output()?;
+    if !output.status.success() {
+        return Err(GitError::Subprocess {
+            cmd: description,
+            status: output.status.code(),
+            stderr: String::from_utf8_lossy(&output.stderr).into_owned(),
+        });
+    }
+    Ok(())
+}
+
+fn file_digest(path: &Path, kind: gix_hash::Kind) -> Result<ObjectId, GitError> {
+    let mut file = std::fs::File::open(path)?;
+    let size = file.metadata()?.len();
+    let hash_len = kind.len_in_bytes();
+    let payload = size
+        .checked_sub(hash_len as u64)
+        .ok_or_else(|| GitError::InvalidInput("truncated index checksum".into()))?;
+    let mut hashing = gix_hash::io::Write::new(std::io::sink(), kind);
+    if std::io::copy(&mut (&mut file).take(payload), &mut hashing)? != payload {
+        return Err(GitError::InvalidInput("truncated index contents".into()));
+    }
+    let digest = hashing.hash.try_finalize().map_err(ge)?;
+    file.seek(SeekFrom::Start(payload))?;
+    let mut trailer = vec![0; hash_len];
+    file.read_exact(&mut trailer)?;
+    if digest.as_bytes() != trailer {
+        return Err(GitError::InvalidInput("index checksum mismatch".into()));
+    }
+    Ok(digest)
+}
+
+/// Check the exact MIDX and its named bitmap, including both file digests and
+/// bitmap-to-MIDX linkage. Existence or a successful Git write is insufficient.
+pub fn verify_files(repo: &LocalRepo) -> Result<VerifiedMidx, GitError> {
+    let dir = repo.path().join("objects/pack");
+    let kind = repo.object_format().kind();
+    let index_path = dir.join("multi-pack-index");
+    let checksum = file_digest(&index_path, kind)?;
+    let mut index_header = [0; 8];
+    std::fs::File::open(&index_path)?.read_exact(&mut index_header)?;
+    let hash_id = match kind {
+        gix_hash::Kind::Sha1 => 1,
+        gix_hash::Kind::Sha256 => 2,
+        _ => {
+            return Err(GitError::InvalidInput(
+                "unsupported bitmap object format".into(),
+            ));
+        }
+    };
+    if index_header.get(..4) != Some(b"MIDX".as_slice())
+        || index_header.get(4) != Some(&1)
+        || index_header.get(5) != Some(&hash_id)
+    {
+        return Err(GitError::InvalidInput(
+            "unsupported MIDX header or object format".into(),
+        ));
+    }
+    let bitmap_path = dir.join(format!("multi-pack-index-{checksum}.bitmap"));
+    file_digest(&bitmap_path, kind)?;
+    let mut file = std::fs::File::open(&bitmap_path)?;
+    let mut header = [0; 12];
+    file.read_exact(&mut header)?;
+    if header.get(..6) != Some(b"BITM\0\x01".as_slice()) || header.get(8..12) == Some(&[0; 4]) {
+        return Err(GitError::InvalidInput(
+            "missing supported nonempty MIDX bitmap".into(),
+        ));
+    }
+    let mut mapping = vec![0; kind.len_in_bytes()];
+    file.read_exact(&mut mapping)?;
+    if checksum.as_bytes() != mapping {
+        return Err(GitError::InvalidInput(
+            "bitmap belongs to another MIDX".into(),
+        ));
+    }
+    Ok(VerifiedMidx {
+        checksum,
+        bitmap_path,
+    })
+}
+
+impl LocalRepo {
+    /// In-memory cache mode, restored from the manifest on every reconciliation.
+    /// It prevents older derived-history maintenance from replacing a full MIDX.
+    pub fn set_segmented_midx_mode(&self, enabled: bool) {
+        self.inner
+            .segmented_midx
+            .store(enabled, std::sync::atomic::Ordering::Release);
+    }
+
+    /// Drop disposable indexes before removing an indexed pack or switching to
+    /// remote-only data. Caller excludes readers and runs off the async runtime.
+    pub fn invalidate_midx(&self) -> Result<(), GitError> {
+        let dir = self.path().join("objects/pack");
+        for entry in std::fs::read_dir(dir)? {
+            let entry = entry?;
+            let name = entry.file_name();
+            let name = name.to_string_lossy();
+            if name == "multi-pack-index"
+                || (name.starts_with("multi-pack-index-")
+                    && (name.ends_with(".bitmap") || name.ends_with(".rev")))
+            {
+                match std::fs::remove_file(entry.path()) {
+                    Ok(()) => {}
+                    Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
+                    Err(e) => return Err(e.into()),
+                }
+            }
+        }
+        Ok(())
+    }
+
+    /// Build over exactly these installed packs, then check file hashes, Git's
+    /// index verification, and a real bitmap graph walk at the captured commit.
+    /// The owned pin moves into the worker so cancellation cannot unpin live
+    /// files while Git still reads them. Isolated scratch callers can pass `()`.
+    pub async fn write_verified_midx<P: Send + 'static>(
+        &self,
+        packs: &[ObjectId],
+        commit: ObjectId,
+        pin: P,
+    ) -> Result<VerifiedMidx, GitError> {
+        let repo = self.clone();
+        let packs = packs.to_vec();
+        tokio::task::spawn_blocking(move || {
+            let _pin = pin;
+            if packs.is_empty()
+                || commit.kind() != repo.object_format().kind()
+                || packs.iter().any(|p| p.kind() != commit.kind())
+            {
+                return Err(GitError::InvalidInput(
+                    "invalid bitmap inventory or commit format".into(),
+                ));
+            }
+            let mut names: Vec<_> = packs.iter().map(|id| format!("pack-{id}.idx")).collect();
+            names.sort();
+            names.dedup();
+            for id in &packs {
+                if !repo.pack_path(id).is_file()
+                    || !repo.pack_path(id).with_extension("idx").is_file()
+                {
+                    return Err(GitError::InvalidInput(
+                        "bitmap requires every selected pack locally readable".into(),
+                    ));
+                }
+            }
+            let input = format!("{}\n", names.join("\n"));
+            checked(
+                Command::new("git").arg("-C").arg(repo.path()).args([
+                    "multi-pack-index",
+                    "write",
+                    "--bitmap",
+                    "--stdin-packs",
+                ]),
+                Some(input.as_bytes()),
+            )?;
+            let verified = verify_files(&repo)?;
+            checked(
+                Command::new("git")
+                    .arg("-C")
+                    .arg(repo.path())
+                    .args(["multi-pack-index", "verify"]),
+                None,
+            )?;
+            checked(
+                Command::new("git").arg("-C").arg(repo.path()).args([
+                    "rev-list",
+                    "--test-bitmap",
+                    &commit.to_string(),
+                ]),
+                None,
+            )?;
+            checked(
+                Command::new("git").arg("-C").arg(repo.path()).args([
+                    "config",
+                    "pack.allowPackReuse",
+                    "multi",
+                ]),
+                None,
+            )?;
+            repo.refresh()?;
+            Ok(verified)
+        })
+        .await
+        .map_err(|e| GitError::Protocol(format!("bitmap task: {e}")))?
+    }
+}
diff --git a/crates/walgit-git/src/object_links.rs b/crates/walgit-git/src/object_links.rs
new file mode 100644
index 0000000..139e45a
--- /dev/null
+++ b/crates/walgit-git/src/object_links.rs
@@ -0,0 +1,246 @@
+//! Raw Git links, independent of reachability accelerators and warm-cache state.
+use std::collections::HashMap;
+
+use gix_hash::ObjectId;
+use gix_object::Kind;
+use walgit_proto::v1::{PackRef, RefSnapshot};
+
+use crate::{GitError, LocalRepo, ge};
+
+/// Visit direct references without inflating blob payloads. Gitlinks name a
+/// different repository and are deliberately excluded. Oversized metadata
+/// refuses bounded maintenance before allocating its full decoded buffer.
+pub fn visit_references(
+    repo: &gix::Repository,
+    id: ObjectId,
+    max_object_bytes: u64,
+    mut visit: impl FnMut(ObjectId, Kind) -> Result<(), GitError>,
+) -> Result<(), GitError> {
+    let header = repo.find_header(id).map_err(ge)?;
+    if header.kind() == Kind::Blob {
+        return Ok(());
+    }
+    if header.size() > max_object_bytes {
+        return Err(GitError::InvalidInput(format!(
+            "metadata object {id} exceeds the {max_object_bytes}-byte validation budget"
+        )));
+    }
+    let object = repo.find_object(id).map_err(ge)?;
+    match object.kind {
+        Kind::Commit => {
+            let commit =
+                gix_object::CommitRef::from_bytes(&object.data, repo.object_hash()).map_err(ge)?;
+            visit(commit.tree(), Kind::Tree)?;
+            for parent in commit.parents() {
+                visit(parent, Kind::Commit)?;
+            }
+        }
+        Kind::Tree => {
+            for entry in gix_object::TreeRefIter::from_bytes(&object.data, repo.object_hash()) {
+                let entry = entry.map_err(ge)?;
+                if !entry.mode.is_commit() {
+                    visit(
+                        entry.oid.to_owned(),
+                        if entry.mode.is_tree() {
+                            Kind::Tree
+                        } else {
+                            Kind::Blob
+                        },
+                    )?;
+                }
+            }
+        }
+        Kind::Tag => {
+            let tag =
+                gix_object::TagRef::from_bytes(&object.data, repo.object_hash()).map_err(ge)?;
+            visit(tag.target(), tag.target_kind)?;
+        }
+        Kind::Blob => {}
+    }
+    Ok(())
+}
+
+/// Validate every indexed object, including unreachable commits/trees/tags.
+/// The caller must supply an isolated ODB containing exactly captured committed
+/// packs. Checking all direct edges there proves closure without a global walk
+/// or an unbounded in-memory object set. Run on a blocking worker.
+pub fn verify_indexed_links(
+    local: &LocalRepo,
+    packs: &[PackRef],
+    refs: &RefSnapshot,
+    max_object_bytes: u64,
+) -> Result<(), GitError> {
+    let mut repo = local.gix();
+    repo.object_cache_size(
+        usize::try_from((max_object_bytes / 4).min(64 * 1024 * 1024)).map_err(ge)?,
+    );
+    let mut kinds = HashMap::new();
+    for pack in packs {
+        let checksum = ObjectId::from_hex(pack.checksum.as_bytes()).map_err(ge)?;
+        let index = gix_pack::index::File::at(
+            local.pack_path(&checksum).with_extension("idx"),
+            local.object_format().kind(),
+        )
+        .map_err(ge)?;
+        for entry in index.iter() {
+            visit_references(&repo, entry.oid, max_object_bytes, |target, expected| {
+                let actual = if let Some(kind) = kinds.get(&target) {
+                    *kind
+                } else {
+                    let kind = repo
+                        .find_header(target)
+                        .map_err(|error| {
+                            GitError::InvalidInput(format!(
+                                "indexed object {} references unavailable object {target}: {error}",
+                                entry.oid
+                            ))
+                        })?
+                        .kind();
+                    if kinds.len() >= 4096 {
+                        kinds.clear();
+                    }
+                    kinds.insert(target, kind);
+                    kind
+                };
+                if actual != expected {
+                    return Err(GitError::InvalidInput(format!(
+                        "indexed object {} references {target} as {expected:?}, but found {actual:?}",
+                        entry.oid
+                    )));
+                }
+                Ok(())
+            })?;
+        }
+    }
+    for reference in &refs.refs {
+        let id = ObjectId::from_hex(reference.oid.as_bytes()).map_err(ge)?;
+        repo.find_header(id).map_err(ge)?;
+    }
+    Ok(())
+}
+
+/// Parse and verify the exact index identity before admitting it as membership evidence.
+pub fn verified_index(
+    path: &std::path::Path,
+    pack: &PackRef,
+    hash: gix_hash::Kind,
+) -> Result<gix_pack::index::File, GitError> {
+    let size = std::fs::metadata(path)?.len();
+    if pack.idx_size != 0 && size != pack.idx_size {
+        return Err(GitError::InvalidInput("pack index size mismatch".into()));
+    }
+    let index = gix_pack::index::File::at(path, hash).map_err(ge)?;
+    index
+        .verify_checksum(
+            &mut gix_features::progress::Discard,
+            &std::sync::atomic::AtomicBool::new(false),
+        )
+        .map_err(ge)?;
+    if index.pack_checksum().to_string() != pack.checksum
+        || (pack.object_count != 0 && u64::from(index.num_objects()) != pack.object_count)
+    {
+        return Err(GitError::InvalidInput(
+            "pack index identity mismatch".into(),
+        ));
+    }
+    Ok(index)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+
+    fn git(repo: &LocalRepo, args: &[&str], input: &str) -> anyhow::Result<String> {
+        let mut child = Command::new("git")
+            .arg("-C")
+            .arg(repo.path())
+            .args(args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()?;
+        child
+            .stdin
+            .take()
+            .ok_or_else(|| anyhow::anyhow!("missing stdin"))?
+            .write_all(input.as_bytes())?;
+        let output = child.wait_with_output()?;
+        anyhow::ensure!(
+            output.status.success(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        Ok(String::from_utf8(output.stdout)?.trim().to_owned())
+    }
+
+    #[test]
+    fn unreachable_indexed_links_cannot_hide_behind_empty_refs() -> anyhow::Result<()> {
+        for format in [crate::ObjectFormat::Sha1, crate::ObjectFormat::Sha256] {
+            let root = tempfile::tempdir()?;
+            let repo = LocalRepo::init(root.path(), &crate::RepoId::new("o", "raw")?, format)?;
+            let missing = "1".repeat(format.kind().len_in_hex());
+            let commit = git(
+                &repo,
+                &[
+                    "hash-object",
+                    "--literally",
+                    "-w",
+                    "-t",
+                    "commit",
+                    "--stdin",
+                ],
+                &format!(
+                    "tree {missing}\nauthor Test <test@example.invalid> 0 +0000\ncommitter Test <test@example.invalid> 0 +0000\n\nunreachable\n"
+                ),
+            )?;
+            let prefix = repo.path().join("objects/pack/pack");
+            let checksum = git(
+                &repo,
+                &["pack-objects", prefix.to_str().unwrap()],
+                &format!("{commit}\n"),
+            )?;
+            repo.refresh()?;
+            let result = verify_indexed_links(
+                &repo,
+                &[PackRef {
+                    checksum,
+                    ..Default::default()
+                }],
+                &RefSnapshot::default(),
+                1024 * 1024,
+            );
+            assert!(
+                result.is_err(),
+                "unreachable broken input must not be conserved into a new cut"
+            );
+        }
+        Ok(())
+    }
+
+    #[test]
+    fn metadata_budget_is_checked_before_decode_and_blobs_have_no_links() -> anyhow::Result<()> {
+        let root = tempfile::tempdir()?;
+        let local = LocalRepo::init(
+            root.path(),
+            &crate::RepoId::new("o", "budget")?,
+            crate::ObjectFormat::Sha1,
+        )?;
+        let blob = git(&local, &["hash-object", "-w", "--stdin"], &"x".repeat(4096))?;
+        let tree = git(&local, &["mktree"], &format!("100644 blob {blob}\tfile\n"))?;
+        local.refresh()?;
+        let repo = local.gix();
+        let blob = ObjectId::from_hex(blob.as_bytes())?;
+        visit_references(&repo, blob, 1, |_, _| panic!("blob reference"))?;
+        let tree = ObjectId::from_hex(tree.as_bytes())?;
+        assert!(visit_references(&repo, tree, 1, |_, _| Ok(())).is_err());
+        let mut edges = Vec::new();
+        visit_references(&repo, tree, 1024, |oid, kind| {
+            edges.push((oid, kind));
+            Ok(())
+        })?;
+        assert_eq!(edges, vec![(blob, Kind::Blob)]);
+        Ok(())
+    }
+}
diff --git a/crates/walgit-git/src/pack_groups.rs b/crates/walgit-git/src/pack_groups.rs
new file mode 100644
index 0000000..c58f115
--- /dev/null
+++ b/crates/walgit-git/src/pack_groups.rs
@@ -0,0 +1,90 @@
+//! Resolve packaging roots from a captured ref view, independently of discovery.
+//!
+//! This describes graph walks, not evidence that any pack contains their results.
+use std::collections::{BTreeMap, BTreeSet};
+
+use walgit_config::refs::{PackGroupKind, RefsConfig};
+
+use crate::{GitError, RefSnapshotData, validate_ref_name};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct GroupRoots {
+    pub kind: PackGroupKind,
+    /// Positive revision roots; annotated tags remain roots themselves.
+    pub include: Vec<String>,
+    /// Logical roots of subtraction dependencies, before their own subtraction.
+    pub exclude: Vec<String>,
+    /// Complete transitive dependency names needed when delivering this group.
+    pub dependencies: Vec<String>,
+}
+
+/// Resolve deterministic Git revision inputs using only the supplied snapshot.
+/// Unmatched objects must be conserved separately by the packing caller.
+pub fn resolve_groups(
+    config: &RefsConfig,
+    snapshot: &RefSnapshotData,
+) -> Result<BTreeMap<String, GroupRoots>, GitError> {
+    config
+        .validate()
+        .map_err(|e| GitError::InvalidInput(e.to_string()))?;
+    let mut names = BTreeSet::new();
+    for reference in &snapshot.refs {
+        validate_ref_name(&reference.name)?;
+        if reference.name == "HEAD" || !names.insert(&reference.name) {
+            return Err(GitError::InvalidInput(
+                "duplicate or symbolic ref in snapshot".into(),
+            ));
+        }
+        // Revision input is an object id, never a ref name or an option.
+        let oid = gix_hash::ObjectId::from_hex(reference.oid.as_bytes())
+            .map_err(|e| GitError::InvalidInput(e.to_string()))?;
+        if oid.is_null() {
+            return Err(GitError::InvalidInput("null ref target in snapshot".into()));
+        }
+    }
+    let roots: BTreeMap<_, BTreeSet<_>> = config
+        .packfiles
+        .iter()
+        .map(|(name, group)| {
+            let roots = snapshot
+                .refs
+                .iter()
+                .filter(|reference| group.matches_ref(&reference.name, &snapshot.head_target))
+                .map(|reference| reference.oid.clone())
+                .collect();
+            (name.clone(), roots)
+        })
+        .collect();
+    let mut result = BTreeMap::new();
+    for (name, group) in &config.packfiles {
+        let mut dependencies = BTreeSet::new();
+        let mut pending = group.subtract.clone();
+        while let Some(dependency) = pending.pop() {
+            if dependencies.insert(dependency.clone()) {
+                let target = config
+                    .packfiles
+                    .get(&dependency)
+                    .ok_or_else(|| GitError::InvalidInput(format!("missing group {dependency}")))?;
+                pending.extend(target.subtract.iter().cloned());
+            }
+        }
+        // Only direct dependencies define this physical set. Recursing here
+        // would remove objects outside the dependency's logical closure.
+        let exclude: BTreeSet<_> = group
+            .subtract
+            .iter()
+            .filter_map(|dependency| roots.get(dependency))
+            .flat_map(|roots| roots.iter().cloned())
+            .collect();
+        result.insert(
+            name.clone(),
+            GroupRoots {
+                kind: group.kind,
+                include: roots.get(name).into_iter().flatten().cloned().collect(),
+                exclude: exclude.into_iter().collect(),
+                dependencies: dependencies.into_iter().collect(),
+            },
+        );
+    }
+    Ok(result)
+}
diff --git a/crates/walgit-git/src/pack_segments.rs b/crates/walgit-git/src/pack_segments.rs
new file mode 100644
index 0000000..25dbf72
--- /dev/null
+++ b/crates/walgit-git/src/pack_segments.rs
@@ -0,0 +1,895 @@
+//! Conserving physical cuts from an isolated, committed object inventory.
+//!
+//! Inventories are files, sorted with an explicit memory limit. Git supplies path
+//! hints for delta search (its line protocol truncates hints at newlines); actual
+//! tree names and object bytes are never modified. No inventory is a certificate.
+use std::fs::File;
+use std::io::{BufRead, BufReader, BufWriter, Read, Write};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use walgit_config::packs::PacksConfig;
+use walgit_config::refs::{PackGroupKind, RefsConfig};
+use walgit_proto::v1::{PackKind, PackRef};
+
+use crate::maintenance_input::MaintenanceInput;
+use crate::pack_groups::resolve_groups;
+use crate::{GitError, RefSnapshotData, ge};
+
+/// Explicit worker resource headroom. Delta memory bounds the search window,
+/// not Git's total RSS (Git also maintains object metadata and delta buffers).
+#[derive(Debug, Clone, Copy)]
+pub struct Resources {
+    pub sort_memory_bytes: u64,
+    pub delta_memory_bytes: u64,
+    pub threads: usize,
+}
+
+#[derive(Debug, Clone)]
+pub struct SegmentOutput {
+    pub group: String,
+    /// None is the retained family, whose objects matched no physical group.
+    pub audience: Option<PackGroupKind>,
+    pub dependencies: Vec<String>,
+    pub pack: PackRef,
+    pub path: PathBuf,
+    /// Git's size target permits an indivisible oversized object.
+    pub exceeds_target: bool,
+}
+
+pub struct SegmentedInput {
+    pub input: MaintenanceInput,
+    pub outputs: Vec<SegmentOutput>,
+    /// Disk-backed exact input object inventory, useful for final seal checks.
+    pub inventory: PathBuf,
+}
+
+#[derive(Debug)]
+pub struct Family {
+    pub group: String,
+    pub audience: Option<PackGroupKind>,
+    pub dependencies: Vec<String>,
+    pub kind: PackKind,
+    /// Sorted OID + Git path-hint list, readable without producing a pack.
+    pub objects: PathBuf,
+    pub completed: bool,
+}
+
+/// Disposable progress: only a caller's final guarded manifest CAS is durable.
+pub struct SegmentPlan {
+    pub input: MaintenanceInput,
+    pub selected: Vec<PackRef>,
+    pub families: Vec<Family>,
+    pub outputs: Vec<SegmentOutput>,
+    pub inventory: PathBuf,
+    resources: Resources,
+    work: PathBuf,
+}
+
+/// Plan physical families against all committed inputs, rewriting only selected
+/// pack checksums. Frozen inputs can remain readable without being rewritten.
+pub async fn plan(
+    input: MaintenanceInput,
+    selected: Vec<String>,
+    refs: RefsConfig,
+    resources: Resources,
+) -> Result<SegmentPlan, GitError> {
+    tokio::task::spawn_blocking(move || plan_blocking(input, selected, &refs, resources))
+        .await
+        .map_err(ge)?
+}
+
+fn plan_blocking(
+    input: MaintenanceInput,
+    selected: Vec<String>,
+    refs: &RefsConfig,
+    resources: Resources,
+) -> Result<SegmentPlan, GitError> {
+    if resources.sort_memory_bytes == 0 {
+        return Err(invalid("positive sort budget required"));
+    }
+    crate::object_links::verify_indexed_links(
+        &input.repo,
+        &input.packs,
+        &input.refs,
+        resources.sort_memory_bytes,
+    )?;
+    let groups = resolve_groups(refs, &RefSnapshotData::from(input.refs.clone()))?;
+    let work = tempfile::Builder::new()
+        .prefix("segment-work-")
+        .tempdir_in(input.repo.path())?
+        .keep();
+    let raw = work.join("indexed.raw");
+    let mut indexed = BufWriter::new(File::create(&raw)?);
+    let selected: Vec<PackRef> = selected
+        .into_iter()
+        .map(|checksum| {
+            input
+                .packs
+                .iter()
+                .find(|p| p.checksum == checksum)
+                .cloned()
+                .ok_or_else(|| invalid("selected input is not committed"))
+        })
+        .collect::<Result<_, _>>()?;
+    if selected.is_empty() {
+        return Err(invalid("no selected inputs"));
+    }
+    let mut unique = std::collections::BTreeSet::new();
+    if selected.iter().any(|p| !unique.insert(&p.checksum)) {
+        return Err(invalid("duplicate selected input"));
+    }
+    for descriptor in &selected {
+        let path = input
+            .repo
+            .path()
+            .join("objects/pack")
+            .join(format!("pack-{}.idx", descriptor.checksum));
+        append_index(&path, &input, &mut indexed)?;
+    }
+    indexed.flush()?;
+    let inventory = work.join("indexed.sorted");
+    sort(&raw, &inventory, &work, resources)?;
+    let all_raw = work.join("all-indexed.raw");
+    let mut all = BufWriter::new(File::create(&all_raw)?);
+    for descriptor in &input.packs {
+        append_index(
+            &input
+                .repo
+                .path()
+                .join("objects/pack")
+                .join(format!("pack-{}.idx", descriptor.checksum)),
+            &input,
+            &mut all,
+        )?;
+    }
+    all.flush()?;
+    let all_inventory = work.join("all-indexed.sorted");
+    sort(&all_raw, &all_inventory, &work, resources)?;
+    let full_union_raw = work.join("all-groups.raw");
+    let mut full_union = BufWriter::new(File::create(&full_union_raw)?);
+    let union_raw = work.join("groups.raw");
+    let mut union = BufWriter::new(File::create(&union_raw)?);
+    let mut families = Vec::new();
+    for (name, roots) in groups {
+        let revisions = work.join(format!("{name}.revisions"));
+        let mut writer = BufWriter::new(File::create(&revisions)?);
+        for oid in &roots.include {
+            writeln!(writer, "{oid}")?;
+        }
+        for oid in &roots.exclude {
+            writeln!(writer, "^{oid}")?;
+        }
+        writer.flush()?;
+        let raw = work.join(format!("{name}.raw"));
+        if roots.include.is_empty() {
+            File::create(&raw)?;
+        } else {
+            run(
+                git(&input).args(["rev-list", "--objects", "--stdin"]),
+                &revisions,
+                &raw,
+                &work,
+            )?;
+        }
+        let full = work.join(format!("{name}.full"));
+        sort(&raw, &full, &work, resources)?;
+        for line in BufReader::new(File::open(&full)?).split(b'\n') {
+            let line = line?;
+            if line.is_empty() {
+                continue;
+            }
+            full_union.write_all(line.split(|b| *b == b' ').next().unwrap_or_default())?;
+            full_union.write_all(b"\n")?;
+        }
+        let list = work.join(format!("{name}.sorted"));
+        intersect(&full, &inventory, &list)?;
+        for line in BufReader::new(File::open(&list)?).split(b'\n') {
+            let line = line?;
+            if line.is_empty() {
+                continue;
+            }
+            let oid = line.split(|b| *b == b' ').next().unwrap_or_default();
+            union.write_all(oid)?;
+            union.write_all(b"\n")?;
+        }
+        families.push((name, Some(roots.kind), roots.dependencies, list));
+    }
+    union.flush()?;
+    let union_sorted = work.join("groups.sorted");
+    sort(&union_raw, &union_sorted, &work, resources)?;
+    let retained = work.join("_retained.sorted");
+    difference(&inventory, &union_sorted, &retained, &work)?;
+    // Verify the complete walks before selected-input intersection: otherwise
+    // loose objects could masquerade as covered roots outside committed packs.
+    full_union.flush()?;
+    let full_union_sorted = work.join("all-groups.sorted");
+    sort(&full_union_raw, &full_union_sorted, &work, resources)?;
+    let extra = work.join("group-extra");
+    difference(&full_union_sorted, &all_inventory, &extra, &work)?;
+    if std::fs::metadata(extra)?.len() != 0 {
+        return Err(invalid("group graph exceeds committed inventory"));
+    }
+    families.push(("_retained".into(), None, Vec::new(), retained));
+
+    let mut planned = Vec::new();
+    for (group, audience, dependencies, list) in families {
+        let typed = work.join(format!("{group}.typed"));
+        run(
+            git(&input).args([
+                "cat-file",
+                "--batch-check=%(objectname) %(objecttype) %(rest)",
+            ]),
+            &list,
+            &typed,
+            &work,
+        )?;
+        let history = work.join(format!("{group}.history"));
+        let blobs = work.join(format!("{group}.blobs"));
+        split_types(&typed, &history, &blobs)?;
+        for (kind, objects) in [(PackKind::History, history), (PackKind::Blobs, blobs)] {
+            if std::fs::metadata(&objects)?.len() == 0 {
+                continue;
+            }
+            planned.push(Family {
+                group: group.clone(),
+                audience,
+                dependencies: dependencies.clone(),
+                kind,
+                objects,
+                completed: false,
+            });
+        }
+    }
+    Ok(SegmentPlan {
+        input,
+        selected,
+        families: planned,
+        outputs: Vec::new(),
+        inventory,
+        resources,
+        work,
+    })
+}
+
+/// One bounded family unit. All packs from this unit remain additive until the
+/// complete selected input set passes `finish()` and the caller seals its plan.
+pub async fn step(
+    plan: SegmentPlan,
+    family: usize,
+    tuning: PacksConfig,
+) -> Result<SegmentPlan, GitError> {
+    tokio::task::spawn_blocking(move || step_blocking(plan, family, &tuning))
+        .await
+        .map_err(ge)?
+}
+
+fn step_blocking(
+    mut plan: SegmentPlan,
+    family: usize,
+    tuning: &PacksConfig,
+) -> Result<SegmentPlan, GitError> {
+    tuning.validate().map_err(invalid)?;
+    if tuning.target_bytes() < 1024 * 1024 {
+        return Err(invalid("at least 1 MiB pack target required"));
+    }
+    let budget = tuning
+        .delta_budget(plan.resources.threads, plan.resources.delta_memory_bytes)
+        .map_err(invalid)?;
+    let item = plan
+        .families
+        .get(family)
+        .ok_or_else(|| invalid("unknown family"))?;
+    if item.completed {
+        return Ok(plan);
+    }
+    let group = item.group.clone();
+    let audience = item.audience;
+    let dependencies = item.dependencies.clone();
+    let kind = item.kind;
+    let objects = item.objects.clone();
+    let input = &plan.input;
+    let work = plan.work.clone();
+    let dir = work.join(format!("{group}-{}", kind.as_str_name()));
+    std::fs::create_dir(&dir)?;
+    let prefix = dir.join("pack");
+    let hashes = dir.join("hashes");
+    let mut command = git(input);
+    command
+        .args([
+            "-c",
+            "pack.writeReverseIndex=true",
+            "pack-objects",
+            "--non-empty",
+            "--delta-base-offset",
+            "--no-reuse-delta",
+        ])
+        .arg(format!("--max-pack-size={}", tuning.target_bytes()))
+        .arg(format!("--window={}", tuning.segment_delta_window))
+        .arg(format!("--depth={}", tuning.segment_delta_depth))
+        .arg(format!("--threads={}", budget.threads))
+        .arg(format!(
+            "--window-memory={}",
+            budget.window_memory_per_thread
+        ));
+    if !tuning.segment_reuse_objects {
+        command.arg("--no-reuse-object");
+    }
+    command.arg(&prefix);
+    run(&mut command, &objects, &hashes, &work)?;
+    for hash in BufReader::new(File::open(hashes)?).lines() {
+        let hash = hash?;
+        let oid = gix_hash::ObjectId::from_hex(hash.as_bytes()).map_err(ge)?;
+        if oid.kind() != input.repo.object_format().kind() {
+            return Err(invalid("output checksum format mismatch"));
+        }
+        let path = dir.join(format!("pack-{hash}.pack"));
+        // index-pack refuses thin/external delta bases. It verifies the
+        // complete new pack/index pair before any output may be published.
+        run(
+            git(input).args(["index-pack", "--verify"]).arg(&path),
+            &work.join("empty"),
+            &dir.join("verified"),
+            &work,
+        )?;
+        let idx = path.with_extension("idx");
+        let index = gix_pack::index::File::at(&idx, oid.kind()).map_err(ge)?;
+        if index.pack_checksum() != oid {
+            return Err(invalid("output index checksum mismatch"));
+        }
+        let size = std::fs::metadata(&path)?.len();
+        plan.outputs.push(SegmentOutput {
+            group: group.clone(),
+            audience,
+            dependencies: dependencies.clone(),
+            pack: PackRef {
+                checksum: hash,
+                pack_size: size,
+                idx_size: std::fs::metadata(idx)?.len(),
+                object_count: u64::from(index.num_objects()),
+                has_rev: path.with_extension("rev").is_file(),
+                kind: kind.into(),
+                ..Default::default()
+            },
+            path,
+            exceeds_target: size > tuning.target_bytes(),
+        });
+    }
+
+    plan.families
+        .get_mut(family)
+        .ok_or_else(|| invalid("unknown family"))?
+        .completed = true;
+    Ok(plan)
+}
+
+/// Require every unit and exact conservation before final input retirement.
+pub async fn finish(plan: SegmentPlan) -> Result<SegmentedInput, GitError> {
+    tokio::task::spawn_blocking(move || {
+        if plan.families.iter().any(|f| !f.completed) {
+            return Err(invalid("cannot finish an incomplete cut"));
+        }
+        let SegmentPlan {
+            input,
+            outputs,
+            inventory,
+            resources,
+            work,
+            ..
+        } = plan;
+        // Exact union equality is mandatory, including unreachable retained objects.
+        let produced_raw = work.join("produced.raw");
+        let mut produced = BufWriter::new(File::create(&produced_raw)?);
+        for output in &outputs {
+            append_index(&output.path.with_extension("idx"), &input, &mut produced)?;
+        }
+        produced.flush()?;
+        let produced_sorted = work.join("produced.sorted");
+        sort(&produced_raw, &produced_sorted, &work, resources)?;
+        let mismatch = work.join("mismatch");
+        run(
+            Command::new("comm")
+                .args(["-3"])
+                .arg(&inventory)
+                .arg(&produced_sorted),
+            &work.join("empty"),
+            &mismatch,
+            &work,
+        )?;
+        if std::fs::metadata(mismatch)?.len() != 0 {
+            return Err(invalid("segmentation did not conserve indexed objects"));
+        }
+        Ok(SegmentedInput {
+            input,
+            outputs,
+            inventory,
+        })
+    })
+    .await
+    .map_err(ge)?
+}
+
+/// One completed family's disposable output receipt. The server persists its
+/// own policy/input/tuning identity; these fields alone authorize nothing.
+pub struct StepReceipt {
+    pub group: String,
+    pub kind: PackKind,
+    pub outputs: Vec<SegmentOutput>,
+}
+
+/// Rebuild classification from the captured committed view, then verify each
+/// saved output and exact family inventory before skipping any completed unit.
+pub async fn resume(
+    input: MaintenanceInput,
+    selected: Vec<String>,
+    refs: RefsConfig,
+    resources: Resources,
+    receipts: Vec<StepReceipt>,
+) -> Result<SegmentPlan, GitError> {
+    tokio::task::spawn_blocking(move || {
+        let mut plan = plan_blocking(input, selected, &refs, resources)?;
+        let root = plan.input.scratch_root().canonicalize()?;
+        for receipt in receipts {
+            let index = plan
+                .families
+                .iter()
+                .position(|f| f.group == receipt.group && f.kind == receipt.kind)
+                .ok_or_else(|| invalid("receipt family absent from current plan"))?;
+            let family = plan
+                .families
+                .get(index)
+                .ok_or_else(|| invalid("unknown family"))?;
+            if family.completed || receipt.outputs.is_empty() {
+                return Err(invalid("duplicate or empty family receipt"));
+            }
+            let verify_repo = crate::LocalRepo::init(
+                &plan.work.join(format!("verify-{index}")),
+                &crate::RepoId::new("maintenance", "receipt")?,
+                plan.input.repo.object_format(),
+            )?;
+            let raw = plan.work.join(format!("receipt-{index}.raw"));
+            let mut actual = BufWriter::new(File::create(&raw)?);
+            let mut checksums = std::collections::BTreeSet::new();
+            for output in &receipt.outputs {
+                if output.group != family.group
+                    || output.audience != family.audience
+                    || output.dependencies != family.dependencies
+                    || output.pack.kind != i32::from(family.kind)
+                    || !checksums.insert(&output.pack.checksum)
+                {
+                    return Err(invalid("receipt scope mismatch"));
+                }
+                let oid =
+                    gix_hash::ObjectId::from_hex(output.pack.checksum.as_bytes()).map_err(ge)?;
+                if oid.kind() != plan.input.repo.object_format().kind()
+                    || oid.to_string() != output.pack.checksum
+                {
+                    return Err(invalid("receipt checksum mismatch"));
+                }
+                for (ext, required) in [("pack", true), ("idx", true), ("rev", output.pack.has_rev)]
+                {
+                    if !required {
+                        continue;
+                    }
+                    let path = output.path.with_extension(ext).canonicalize()?;
+                    if !path.starts_with(&root)
+                        || path.file_name().is_none_or(|n| {
+                            n != std::ffi::OsStr::new(&format!(
+                                "pack-{}.{ext}",
+                                output.pack.checksum
+                            ))
+                        })
+                    {
+                        return Err(invalid("receipt path escaped its attempt"));
+                    }
+                    let target = verify_repo.path().join("objects/pack").join(
+                        path.file_name()
+                            .ok_or_else(|| invalid("receipt path has no filename"))?,
+                    );
+                    if std::fs::hard_link(&path, &target).is_err() {
+                        std::fs::copy(&path, target)?;
+                    }
+                }
+                crate::maintenance_input::verify(
+                    &verify_repo,
+                    &output.pack,
+                    plan.input.repo.object_format(),
+                )?;
+                append_index(&output.path.with_extension("idx"), &plan.input, &mut actual)?;
+            }
+            actual.flush()?;
+            let actual_sorted = plan.work.join(format!("receipt-{index}.sorted"));
+            sort(&raw, &actual_sorted, &plan.work, resources)?;
+            let expected = plan.work.join(format!("receipt-{index}.expected"));
+            let mut expected_writer = BufWriter::new(File::create(&expected)?);
+            for line in BufReader::new(File::open(&family.objects)?).split(b'\n') {
+                let line = line?;
+                if line.is_empty() {
+                    continue;
+                }
+                expected_writer.write_all(line.split(|b| *b == b' ').next().unwrap_or_default())?;
+                expected_writer.write_all(b"\n")?;
+            }
+            expected_writer.flush()?;
+            let mismatch = plan.work.join(format!("receipt-{index}.mismatch"));
+            run(
+                Command::new("comm")
+                    .arg("-3")
+                    .arg(&expected)
+                    .arg(&actual_sorted),
+                &plan.work.join("empty"),
+                &mismatch,
+                &plan.work,
+            )?;
+            if std::fs::metadata(mismatch)?.len() != 0 {
+                return Err(invalid("receipt does not conserve its planned family"));
+            }
+            plan.families
+                .get_mut(index)
+                .ok_or_else(|| invalid("unknown family"))?
+                .completed = true;
+            plan.outputs.extend(receipt.outputs);
+        }
+        clean_old_work(&plan)?;
+        Ok(plan)
+    })
+    .await
+    .map_err(ge)?
+}
+
+// The input holds an exclusive OS lock. Keep only receipt output directories
+// from old work, after their bytes and family inventories have been verified.
+fn clean_old_work(plan: &SegmentPlan) -> Result<(), GitError> {
+    for entry in std::fs::read_dir(plan.input.repo.path())? {
+        let entry = entry?;
+        let path = entry.path();
+        if !entry.file_type()?.is_dir()
+            || !entry
+                .file_name()
+                .to_string_lossy()
+                .starts_with("segment-work-")
+            || path == plan.work
+        {
+            continue;
+        }
+        if !plan.outputs.iter().any(|o| o.path.starts_with(&path)) {
+            std::fs::remove_dir_all(path)?;
+            continue;
+        }
+        for child in std::fs::read_dir(&path)? {
+            let child = child?;
+            let child_path = child.path();
+            if plan.outputs.iter().any(|o| o.path.starts_with(&child_path)) {
+                continue;
+            }
+            if child.file_type()?.is_dir() {
+                std::fs::remove_dir_all(child_path)?;
+            } else {
+                std::fs::remove_file(child_path)?;
+            }
+        }
+    }
+    Ok(())
+}
+
+/// Convenience full-cut runner. Steps always disable reuse of existing deltas.
+pub async fn segment(
+    input: MaintenanceInput,
+    refs: RefsConfig,
+    tuning: PacksConfig,
+    resources: Resources,
+) -> Result<SegmentedInput, GitError> {
+    let selected = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let mut plan = plan(input, selected, refs, resources).await?;
+    for index in 0..plan.families.len() {
+        plan = step(plan, index, tuning.clone()).await?;
+    }
+    finish(plan).await
+}
+
+/// Merge a sorted path-hint inventory with sorted selected OIDs, keeping one
+/// line from each file in memory. OIDs are fixed-width lowercase hex.
+fn intersect(list: &Path, selected: &Path, output: &Path) -> Result<(), GitError> {
+    let mut ids = BufReader::new(File::open(selected)?).split(b'\n');
+    let mut current = ids.next().transpose()?;
+    let mut out = BufWriter::new(File::create(output)?);
+    for line in BufReader::new(File::open(list)?).split(b'\n') {
+        let line = line?;
+        if line.is_empty() {
+            continue;
+        }
+        let oid = line.split(|b| *b == b' ').next().unwrap_or_default();
+        while current.as_deref().is_some_and(|id| id < oid) {
+            current = ids.next().transpose()?;
+        }
+        if current.as_deref() == Some(oid) {
+            out.write_all(&line)?;
+            out.write_all(b"\n")?;
+        }
+        if current.is_none() {
+            break;
+        }
+    }
+    out.flush()?;
+    Ok(())
+}
+
+fn invalid(e: impl std::fmt::Display) -> GitError {
+    GitError::InvalidInput(e.to_string())
+}
+
+fn git(input: &MaintenanceInput) -> Command {
+    let mut command = Command::new("git");
+    command.arg("-C").arg(input.repo.path());
+    command
+}
+
+fn append_index(
+    path: &Path,
+    input: &MaintenanceInput,
+    out: &mut impl Write,
+) -> Result<(), GitError> {
+    let index = gix_pack::index::File::at(path, input.repo.object_format().kind()).map_err(ge)?;
+    for entry in index.iter() {
+        writeln!(out, "{}", entry.oid)?;
+    }
+    Ok(())
+}
+
+fn sort(input: &Path, output: &Path, work: &Path, resources: Resources) -> Result<(), GitError> {
+    run(
+        Command::new("sort")
+            .args(["--stable", "--unique", "--key=1,1", "--parallel=1"])
+            .arg(format!("--buffer-size={}", resources.sort_memory_bytes))
+            .arg("--temporary-directory")
+            .arg(work),
+        input,
+        output,
+        work,
+    )
+}
+
+fn difference(a: &Path, b: &Path, output: &Path, work: &Path) -> Result<(), GitError> {
+    run(
+        Command::new("comm").arg("-23").arg(a).arg(b),
+        &work.join("empty"),
+        output,
+        work,
+    )
+}
+
+fn run(command: &mut Command, input: &Path, output: &Path, work: &Path) -> Result<(), GitError> {
+    let empty = work.join("empty");
+    if !empty.exists() {
+        File::create(&empty)?;
+    }
+    let error = work.join("command.stderr");
+    let status = command
+        .env("LC_ALL", "C")
+        .stdin(File::open(input)?)
+        .stdout(File::create(output)?)
+        .stderr(File::create(&error)?)
+        .status()?;
+    if !status.success() {
+        let mut stderr = String::new();
+        File::open(error)?
+            .take(64 * 1024)
+            .read_to_string(&mut stderr)?;
+        return Err(GitError::Subprocess {
+            cmd: format!("{command:?}"),
+            status: status.code(),
+            stderr,
+        });
+    }
+    Ok(())
+}
+
+fn split_types(typed: &Path, history: &Path, blobs: &Path) -> Result<(), GitError> {
+    let mut history = BufWriter::new(File::create(history)?);
+    let mut blobs = BufWriter::new(File::create(blobs)?);
+    for line in BufReader::new(File::open(typed)?).split(b'\n') {
+        let line = line?;
+        if line.is_empty() {
+            continue;
+        }
+        // Split exactly twice. Everything after the type is Git's path hint,
+        // including spaces, tabs and non-UTF8 bytes, passed back unchanged.
+        let mut fields = line.splitn(3, |b| *b == b' ');
+        let oid = fields.next().unwrap_or_default();
+        let kind = fields.next().unwrap_or_default();
+        let path = fields.next().unwrap_or_default();
+        gix_hash::ObjectId::from_hex(oid).map_err(ge)?;
+        let out = match kind {
+            b"blob" => &mut blobs,
+            b"commit" | b"tree" | b"tag" => &mut history,
+            _ => {
+                return Err(invalid(
+                    "missing or unsupported object while classifying segment",
+                ));
+            }
+        };
+        out.write_all(oid)?;
+        if !path.is_empty() {
+            out.write_all(b" ")?;
+            out.write_all(path)?;
+        }
+        out.write_all(b"\n")?;
+    }
+    history.flush()?;
+    blobs.flush()?;
+    Ok(())
+}
+
+#[derive(Debug)]
+pub struct PackMembership {
+    pub checksum: String,
+    /// Groups containing every indexed object in this pack, never their union.
+    pub groups: Vec<String>,
+    pub kind: PackKind,
+    pub audience: Option<PackGroupKind>,
+    pub mixed: bool,
+}
+
+#[derive(Debug)]
+pub struct Classification {
+    pub packs: Vec<PackMembership>,
+    /// Exact family coverage from fully scoped member packs. Subset plans never
+    /// certify a complete captured group graph.
+    pub group_complete: std::collections::BTreeMap<String, bool>,
+}
+
+/// Inspect disk-backed family inventories without rewriting any pack bytes.
+pub async fn classify(plan: SegmentPlan) -> Result<(SegmentPlan, Classification), GitError> {
+    tokio::task::spawn_blocking(move || {
+        let mut memberships = Vec::new();
+        for descriptor in &plan.selected {
+            let path = plan
+                .input
+                .repo
+                .path()
+                .join("objects/pack")
+                .join(format!("pack-{}.idx", descriptor.checksum));
+            let index = gix_pack::index::File::at(&path, plan.input.repo.object_format().kind())
+                .map_err(ge)?;
+            let mut counts =
+                std::collections::BTreeMap::<String, (u64, Option<PackGroupKind>)>::new();
+            let mut history = false;
+            let mut blobs = false;
+            for family in &plan.families {
+                let count = intersection_count(&index, &family.objects)?;
+                let entry = counts
+                    .entry(family.group.clone())
+                    .or_insert((0, family.audience));
+                entry.0 += count;
+                if count > 0 {
+                    history |= family.kind == PackKind::History;
+                    blobs |= family.kind == PackKind::Blobs;
+                }
+            }
+            let common: Vec<_> = counts
+                .into_iter()
+                .filter(|(_, (count, _))| *count == descriptor.object_count && *count > 0)
+                .collect();
+            let audience = if common
+                .iter()
+                .any(|(_, (_, kind))| *kind == Some(PackGroupKind::Code))
+            {
+                Some(PackGroupKind::Code)
+            } else if common
+                .iter()
+                .any(|(_, (_, kind))| *kind == Some(PackGroupKind::Meta))
+            {
+                Some(PackGroupKind::Meta)
+            } else {
+                None
+            };
+            let groups = common.into_iter().map(|(name, _)| name).collect::<Vec<_>>();
+            let kind = match (history, blobs) {
+                (true, false) => PackKind::History,
+                (false, true) => PackKind::Blobs,
+                _ => PackKind::Objects,
+            };
+            let mixed = groups.is_empty();
+            memberships.push(PackMembership {
+                checksum: descriptor.checksum.clone(),
+                groups,
+                kind,
+                audience,
+                mixed,
+            });
+        }
+        let all_selected = plan.selected.len() == plan.input.packs.len();
+        let mut complete = std::collections::BTreeMap::new();
+        for family in &plan.families {
+            complete.entry(family.group.clone()).or_insert(all_selected);
+        }
+        for (group, complete) in &mut complete {
+            if !*complete || group == "_retained" {
+                *complete = false;
+                continue;
+            }
+            let expected_raw = plan
+                .work
+                .join(format!("classification-{group}.expected-raw"));
+            let mut expected = BufWriter::new(File::create(&expected_raw)?);
+            for family in plan.families.iter().filter(|f| &f.group == group) {
+                for line in BufReader::new(File::open(&family.objects)?).split(b'\n') {
+                    let line = line?;
+                    if line.is_empty() {
+                        continue;
+                    }
+                    expected.write_all(line.split(|b| *b == b' ').next().unwrap_or_default())?;
+                    expected.write_all(b"\n")?;
+                }
+            }
+            expected.flush()?;
+            let expected_sorted = plan.work.join(format!("classification-{group}.expected"));
+            sort(&expected_raw, &expected_sorted, &plan.work, plan.resources)?;
+            let actual_raw = plan.work.join(format!("classification-{group}.actual-raw"));
+            let mut actual = BufWriter::new(File::create(&actual_raw)?);
+            for member in memberships
+                .iter()
+                .filter(|m| !m.mixed && m.groups.contains(group))
+            {
+                let idx = plan
+                    .input
+                    .repo
+                    .path()
+                    .join("objects/pack")
+                    .join(format!("pack-{}.idx", member.checksum));
+                append_index(&idx, &plan.input, &mut actual)?;
+            }
+            actual.flush()?;
+            let actual_sorted = plan.work.join(format!("classification-{group}.actual"));
+            sort(&actual_raw, &actual_sorted, &plan.work, plan.resources)?;
+            let mismatch = plan.work.join(format!("classification-{group}.mismatch"));
+            run(
+                Command::new("comm")
+                    .arg("-3")
+                    .arg(expected_sorted)
+                    .arg(actual_sorted),
+                &plan.work.join("empty"),
+                &mismatch,
+                &plan.work,
+            )?;
+            *complete = std::fs::metadata(mismatch)?.len() == 0;
+        }
+        Ok((
+            plan,
+            Classification {
+                packs: memberships,
+                group_complete: complete,
+            },
+        ))
+    })
+    .await
+    .map_err(ge)?
+}
+
+fn intersection_count(index: &gix_pack::index::File, list: &Path) -> Result<u64, GitError> {
+    let mut objects = index.iter().peekable();
+    let mut count = 0;
+    for line in BufReader::new(File::open(list)?).split(b'\n') {
+        let line = line?;
+        if line.is_empty() {
+            continue;
+        }
+        let oid =
+            gix_hash::ObjectId::from_hex(line.split(|b| *b == b' ').next().unwrap_or_default())
+                .map_err(ge)?;
+        while objects.peek().is_some_and(|entry| entry.oid < oid) {
+            objects.next();
+        }
+        if objects.peek().is_some_and(|entry| entry.oid == oid) {
+            count += 1;
+        }
+        if objects.peek().is_none() {
+            break;
+        }
+    }
+    Ok(count)
+}
+
+#[cfg(test)]
+#[path = "pack_segments_tests.rs"]
+mod tests;
diff --git a/crates/walgit-git/src/pack_segments_tests.rs b/crates/walgit-git/src/pack_segments_tests.rs
new file mode 100644
index 0000000..5a9b903
--- /dev/null
+++ b/crates/walgit-git/src/pack_segments_tests.rs
@@ -0,0 +1,755 @@
+use super::*;
+use crate::{LocalRepo, ObjectFormat, RepoId};
+use std::process::Stdio;
+use walgit_config::ByteSize;
+use walgit_config::refs::PackGroupConfig;
+use walgit_proto::v1::{Ref, RefSnapshot};
+
+fn command(cwd: &Path, args: &[&str], input: &[u8]) -> Vec<u8> {
+    let mut child = Command::new("git")
+        .arg("-C")
+        .arg(cwd)
+        .args(args)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
+        .unwrap();
+    child.stdin.take().unwrap().write_all(input).unwrap();
+    let out = child.wait_with_output().unwrap();
+    assert!(
+        out.status.success(),
+        "git {args:?}: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    out.stdout
+}
+
+fn text(cwd: &Path, args: &[&str]) -> String {
+    String::from_utf8(command(cwd, args, b""))
+        .unwrap()
+        .trim()
+        .into()
+}
+
+async fn fixture(
+    format: ObjectFormat,
+) -> (tempfile::TempDir, MaintenanceInput, String, Vec<String>) {
+    let root = tempfile::tempdir().unwrap();
+    let work = root.path().join("source");
+    std::fs::create_dir(&work).unwrap();
+    text(
+        &work,
+        &[
+            "init",
+            "-b",
+            "main",
+            &format!("--object-format={}", format.as_str()),
+        ],
+    );
+    text(&work, &["config", "user.name", "Fixture"]);
+    text(&work, &["config", "user.email", "fixture@example.invalid"]);
+    let names = vec![
+        "space name.txt".into(),
+        "tab\tname.txt".into(),
+        "line\nname.txt".into(),
+        "nested/é.txt".into(),
+    ];
+    std::fs::create_dir(work.join("nested")).unwrap();
+    for (index, name) in names.iter().enumerate() {
+        std::fs::write(work.join(name), format!("fixture {index}\n")).unwrap();
+    }
+    text(&work, &["add", "."]);
+    text(&work, &["commit", "-qm", "main"]);
+    text(&work, &["tag", "-a", "v1", "-m", "annotated"]);
+    text(&work, &["checkout", "-qb", "topic"]);
+    std::fs::write(work.join("topic.txt"), "topic bytes").unwrap();
+    text(&work, &["add", "."]);
+    text(&work, &["commit", "-qm", "topic"]);
+    text(&work, &["checkout", "-q", "main"]);
+    let meta_blob = String::from_utf8(command(
+        &work,
+        &["hash-object", "-w", "--stdin"],
+        b"metadata-only payload",
+    ))
+    .unwrap();
+    let mut entries = command(&work, &["ls-tree", "-z", "HEAD"], b"");
+    entries.extend_from_slice(
+        format!("100644 blob {}\tmetadata-only.txt\0", meta_blob.trim()).as_bytes(),
+    );
+    let tree = String::from_utf8(command(&work, &["mktree", "-z"], &entries))
+        .unwrap()
+        .trim()
+        .to_owned();
+    let meta = String::from_utf8(command(
+        &work,
+        &["commit-tree", &tree, "-m", "metadata"],
+        b"",
+    ))
+    .unwrap();
+    text(&work, &["update-ref", "refs/meta/state", meta.trim()]);
+    text(&work, &["repack", "-ad"]);
+    let orphan = String::from_utf8(command(
+        &work,
+        &["hash-object", "-w", "--stdin"],
+        b"unreachable retained payload",
+    ))
+    .unwrap()
+    .trim()
+    .to_owned();
+    let prefix = work.join(".git/objects/pack/pack");
+    command(
+        &work,
+        &["pack-objects", prefix.to_str().unwrap()],
+        format!("{orphan}\n").as_bytes(),
+    );
+    let mut packs = Vec::new();
+    for entry in std::fs::read_dir(work.join(".git/objects/pack")).unwrap() {
+        let path = entry.unwrap().path();
+        if path.extension().is_some_and(|e| e == "idx") {
+            let index = gix_pack::index::File::at(&path, format.kind()).unwrap();
+            packs.push(PackRef {
+                checksum: index.pack_checksum().to_string(),
+                object_count: u64::from(index.num_objects()),
+                idx_size: std::fs::metadata(&path).unwrap().len(),
+                pack_size: std::fs::metadata(path.with_extension("pack"))
+                    .unwrap()
+                    .len(),
+                ..Default::default()
+            });
+        }
+    }
+    let refs = text(
+        &work,
+        &["for-each-ref", "--format=%(refname) %(objectname)"],
+    )
+    .lines()
+    .map(|line| {
+        let (name, oid) = line.split_once(' ').unwrap();
+        Ref {
+            name: name.into(),
+            oid: oid.into(),
+            peeled: String::new(),
+        }
+    })
+    .collect();
+    let snapshot = RefSnapshot {
+        object_format: format.as_str().into(),
+        refs,
+        head_target: "refs/heads/main".into(),
+        ..Default::default()
+    };
+    let input = crate::maintenance_input::prepare(
+        work.join(".git"),
+        root.path().join("attempts"),
+        packs,
+        snapshot,
+        (),
+    )
+    .await
+    .unwrap();
+    (root, input, orphan, names)
+}
+
+fn resources() -> Resources {
+    Resources {
+        sort_memory_bytes: 1024 * 1024,
+        delta_memory_bytes: 1024 * 1024,
+        threads: 1,
+    }
+}
+
+#[tokio::test]
+async fn conserving_groups_reconstruct_tags_dependencies_and_unusual_tree_names() {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let (root, input, orphan, names) = fixture(format).await;
+        let mut refs = RefsConfig::default();
+        refs.packfiles.get_mut("code").unwrap().include =
+            vec!["refs/heads/main".into(), "refs/tags/*".into()];
+        refs.packfiles.insert(
+            "topic".into(),
+            PackGroupConfig {
+                kind: PackGroupKind::Code,
+                include: vec!["refs/heads/topic".into()],
+                subtract: vec!["code".into()],
+            },
+        );
+        let result = segment(input, refs, PacksConfig::default(), resources())
+            .await
+            .unwrap();
+        assert!(
+            result
+                .outputs
+                .iter()
+                .any(|o| o.group == "topic" && o.dependencies == ["code"])
+        );
+        assert!(
+            result
+                .outputs
+                .iter()
+                .any(|o| o.group == "meta" && o.audience == Some(PackGroupKind::Meta))
+        );
+        assert!(
+            result
+                .outputs
+                .iter()
+                .any(|o| o.group == "_retained" && o.audience.is_none())
+        );
+        let rebuilt = LocalRepo::init(
+            &root.path().join("rebuilt"),
+            &RepoId::new("fixture", "repo").unwrap(),
+            format,
+        )
+        .unwrap();
+        let meta_only = text(
+            result.input.repo.path(),
+            &["rev-parse", "refs/meta/state:metadata-only.txt"],
+        );
+        for output in &result.outputs {
+            assert!(!output.exceeds_target);
+            let index = gix_pack::index::File::at(output.path.with_extension("idx"), format.kind())
+                .unwrap();
+            for entry in index.iter() {
+                if output.audience == Some(PackGroupKind::Code) {
+                    assert_ne!(entry.oid.to_string(), meta_only);
+                }
+                let kind = text(
+                    result.input.repo.path(),
+                    &["cat-file", "-t", &entry.oid.to_string()],
+                );
+                assert_eq!(
+                    kind == "blob",
+                    output.pack.kind == i32::from(PackKind::Blobs)
+                );
+            }
+            for ext in ["pack", "idx", "rev"] {
+                let path = output.path.with_extension(ext);
+                if path.exists() {
+                    let target = rebuilt
+                        .path()
+                        .join("objects/pack")
+                        .join(path.file_name().unwrap());
+                    if !target.exists() {
+                        std::fs::copy(&path, target).unwrap();
+                    }
+                }
+            }
+        }
+        rebuilt.load_ref_snapshot(&result.input.refs).unwrap();
+        text(rebuilt.path(), &["fsck", "--full", "--strict"]);
+        assert_eq!(
+            text(rebuilt.path(), &["cat-file", "blob", &orphan]),
+            "unreachable retained payload"
+        );
+        assert_eq!(
+            text(rebuilt.path(), &["cat-file", "-t", "refs/tags/v1"]),
+            "tag"
+        );
+        for (index, name) in names.iter().enumerate() {
+            assert_eq!(
+                command(
+                    rebuilt.path(),
+                    &["show", &format!("refs/heads/main:{name}")],
+                    b""
+                ),
+                format!("fixture {index}\n").as_bytes()
+            );
+        }
+        // Paths with spaces and tabs retain their complete Git hints. Git's
+        // newline-oriented rev-list truncates the newline hint; the test above
+        // proves the actual newline-containing tree name and blob survive.
+        let hints = std::fs::read(result.inventory.parent().unwrap().join("code.blobs")).unwrap();
+        assert!(
+            hints
+                .windows(b"space name.txt".len())
+                .any(|w| w == b"space name.txt")
+        );
+        assert!(
+            hints
+                .windows(b"tab\tname.txt".len())
+                .any(|w| w == b"tab\tname.txt")
+        );
+    }
+}
+
+#[tokio::test]
+async fn empty_groups_conserve_everything_and_invalid_budgets_fail() {
+    let (_root, input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let mut refs = RefsConfig::default();
+    refs.packfiles.clear();
+    let result = segment(input, refs, PacksConfig::default(), resources())
+        .await
+        .unwrap();
+    assert!(result.outputs.iter().all(|o| o.group == "_retained"));
+    assert!(
+        result
+            .outputs
+            .iter()
+            .any(|o| o.pack.kind == i32::from(PackKind::History))
+    );
+    assert!(
+        result
+            .outputs
+            .iter()
+            .any(|o| o.pack.kind == i32::from(PackKind::Blobs))
+    );
+    let (_root, input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let bad = Resources {
+        sort_memory_bytes: 0,
+        ..resources()
+    };
+    assert!(
+        segment(input, RefsConfig::default(), PacksConfig::default(), bad)
+            .await
+            .is_err()
+    );
+}
+
+#[test]
+fn type_split_keeps_hint_bytes_and_rejects_missing_objects() {
+    let root = tempfile::tempdir().unwrap();
+    let typed = root.path().join("typed");
+    let history = root.path().join("history");
+    let blobs = root.path().join("blobs");
+    let oid = "12".repeat(20);
+    std::fs::write(
+        &typed,
+        format!("{oid} blob  spaced\tpath\n{oid} tag tag name\n"),
+    )
+    .unwrap();
+    split_types(&typed, &history, &blobs).unwrap();
+    assert_eq!(
+        std::fs::read(blobs.clone()).unwrap(),
+        format!("{oid}  spaced\tpath\n").as_bytes()
+    );
+    std::fs::write(&typed, format!("{oid} missing\n")).unwrap();
+    assert!(split_types(&typed, &history, &blobs).is_err());
+}
+
+#[tokio::test]
+async fn selected_subset_is_additive_until_all_planned_steps_finish() {
+    let (_root, input, orphan, _) = fixture(ObjectFormat::Sha1).await;
+    let selected = input
+        .packs
+        .iter()
+        .find(|p| p.object_count == 1)
+        .unwrap()
+        .checksum
+        .clone();
+    let mut plan = plan(
+        input,
+        vec![selected.clone()],
+        RefsConfig::default(),
+        resources(),
+    )
+    .await
+    .unwrap();
+    assert_eq!(plan.selected.len(), 1);
+    assert_eq!(plan.selected[0].checksum, selected);
+    assert_eq!(plan.families.len(), 1);
+    assert_eq!(plan.families[0].group, "_retained");
+    assert!(plan.outputs.is_empty());
+    plan = step(plan, 0, PacksConfig::default()).await.unwrap();
+    let count = plan.outputs.len();
+    plan = step(plan, 0, PacksConfig::default()).await.unwrap();
+    assert_eq!(plan.outputs.len(), count);
+    let result = finish(plan).await.unwrap();
+    assert_eq!(
+        std::fs::read_to_string(result.inventory).unwrap().trim(),
+        orphan
+    );
+    assert_eq!(
+        result
+            .outputs
+            .iter()
+            .map(|p| p.pack.object_count)
+            .sum::<u64>(),
+        1
+    );
+    let (_root, input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let checksums = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let incomplete = super::plan(input, checksums, RefsConfig::default(), resources())
+        .await
+        .unwrap();
+    assert!(finish(incomplete).await.is_err());
+}
+
+#[tokio::test]
+async fn target_splits_packs_and_reports_indivisible_oversized_object() {
+    let root = tempfile::tempdir().unwrap();
+    let source = LocalRepo::init(
+        root.path(),
+        &RepoId::new("fixture", "source").unwrap(),
+        ObjectFormat::Sha1,
+    )
+    .unwrap();
+    let mut state = 17_u64;
+    let mut ids = String::new();
+    for size in [2 * 1024 * 1024, 600 * 1024, 600 * 1024, 600 * 1024] {
+        let bytes: Vec<u8> = (0..size)
+            .map(|_| {
+                state ^= state << 13;
+                state ^= state >> 7;
+                state ^= state << 17;
+                state.to_le_bytes()[0]
+            })
+            .collect();
+        ids.push_str(
+            &String::from_utf8(command(
+                source.path(),
+                &["hash-object", "-w", "--stdin"],
+                &bytes,
+            ))
+            .unwrap(),
+        );
+    }
+    let prefix = source.path().join("objects/pack/pack");
+    let checksum = String::from_utf8(command(
+        source.path(),
+        &["pack-objects", prefix.to_str().unwrap()],
+        ids.as_bytes(),
+    ))
+    .unwrap()
+    .trim()
+    .to_owned();
+    let path = source
+        .path()
+        .join("objects/pack")
+        .join(format!("pack-{checksum}.pack"));
+    let pack = PackRef {
+        checksum,
+        object_count: 4,
+        pack_size: std::fs::metadata(&path).unwrap().len(),
+        idx_size: std::fs::metadata(path.with_extension("idx")).unwrap().len(),
+        ..Default::default()
+    };
+    let input = crate::maintenance_input::prepare(
+        source.path().to_path_buf(),
+        root.path().join("attempt"),
+        vec![pack],
+        RefSnapshot {
+            object_format: "sha1".into(),
+            ..Default::default()
+        },
+        (),
+    )
+    .await
+    .unwrap();
+    let tuning = PacksConfig {
+        segment_max_bytes: ByteSize::mib(1),
+        ..Default::default()
+    };
+    let result = segment(input, RefsConfig::default(), tuning, resources())
+        .await
+        .unwrap();
+    assert!(result.outputs.len() >= 3);
+    let oversized: Vec<_> = result.outputs.iter().filter(|p| p.exceeds_target).collect();
+    assert_eq!(oversized.len(), 1);
+    assert_eq!(oversized[0].pack.object_count, 1);
+    assert_eq!(
+        result
+            .outputs
+            .iter()
+            .map(|p| p.pack.object_count)
+            .sum::<u64>(),
+        4
+    );
+}
+
+#[tokio::test]
+async fn resume_reclassifies_and_verifies_saved_family_bytes() {
+    let (_root, input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let selected: Vec<_> = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let descriptors = input.packs.clone();
+    let snapshot = input.refs.clone();
+    let mut original = plan(input, selected.clone(), RefsConfig::default(), resources())
+        .await
+        .unwrap();
+    original = step(original, 0, PacksConfig::default()).await.unwrap();
+    let receipt = StepReceipt {
+        group: original.families[0].group.clone(),
+        kind: original.families[0].kind,
+        outputs: original.outputs.clone(),
+    };
+    let corrupt = receipt.outputs[0].path.clone();
+    let saved_outputs = receipt.outputs.clone();
+    let saved_group = receipt.group.clone();
+    let saved_kind = receipt.kind;
+    let scratch = original.input.persist();
+    drop(original);
+    let input =
+        crate::maintenance_input::reopen(scratch.clone(), descriptors.clone(), snapshot.clone())
+            .await
+            .unwrap();
+    let mut resumed = resume(
+        input,
+        selected.clone(),
+        RefsConfig::default(),
+        resources(),
+        vec![receipt],
+    )
+    .await
+    .unwrap();
+    assert!(resumed.families[0].completed);
+    assert_eq!(resumed.outputs.len(), saved_outputs.len());
+    for index in 0..resumed.families.len() {
+        resumed = step(resumed, index, PacksConfig::default()).await.unwrap();
+    }
+    finish(resumed).await.unwrap();
+    // A saved receipt with a valid-looking checksum cannot skip corrupted bytes.
+    let mut bytes = std::fs::read(&corrupt).unwrap();
+    bytes[12] ^= 1;
+    std::fs::remove_file(&corrupt).unwrap();
+    std::fs::write(&corrupt, bytes).unwrap();
+    let input = crate::maintenance_input::reopen(scratch.clone(), descriptors, snapshot)
+        .await
+        .unwrap();
+    let receipt = StepReceipt {
+        group: saved_group,
+        kind: saved_kind,
+        outputs: saved_outputs,
+    };
+    assert!(
+        resume(
+            input,
+            selected,
+            RefsConfig::default(),
+            resources(),
+            vec![receipt]
+        )
+        .await
+        .is_err()
+    );
+    std::fs::remove_dir_all(scratch).unwrap();
+}
+
+#[tokio::test]
+async fn reopened_input_rejects_uncommitted_loose_objects() {
+    let (_root, mut input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let descriptors = input.packs.clone();
+    let snapshot = input.refs.clone();
+    let scratch = input.persist();
+    command(
+        input.repo.path(),
+        &["hash-object", "-w", "--stdin"],
+        b"uncommitted scratch object",
+    );
+    drop(input);
+    assert!(
+        crate::maintenance_input::reopen(scratch.clone(), descriptors, snapshot)
+            .await
+            .is_err()
+    );
+    std::fs::remove_dir_all(scratch).unwrap();
+}
+
+#[tokio::test]
+async fn persisted_attempt_cannot_reopen_until_its_owner_exits() {
+    let (_root, mut input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let scratch = input.persist();
+    let packs = input.packs.clone();
+    let refs = input.refs.clone();
+    assert!(
+        crate::maintenance_input::reopen(scratch.clone(), packs.clone(), refs.clone())
+            .await
+            .is_err()
+    );
+    drop(input);
+    let reopened = crate::maintenance_input::reopen(scratch.clone(), packs, refs)
+        .await
+        .unwrap();
+    drop(reopened);
+    std::fs::remove_dir_all(scratch).unwrap();
+}
+
+#[tokio::test]
+async fn classification_uses_common_groups_and_cannot_certify_mixed_pack() {
+    let (_root, input, orphan, _) = fixture(ObjectFormat::Sha1).await;
+    let selected = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let initial = plan(input, selected, RefsConfig::default(), resources())
+        .await
+        .unwrap();
+    let (initial, classification) = classify(initial).await.unwrap();
+    assert!(
+        classification
+            .packs
+            .iter()
+            .any(|p| p.mixed && p.kind == PackKind::Objects)
+    );
+    let retained = classification
+        .packs
+        .iter()
+        .find(|p| p.groups == ["_retained"])
+        .unwrap();
+    assert_eq!(retained.kind, PackKind::Blobs);
+    assert!(!retained.mixed);
+    assert!(
+        classification
+            .group_complete
+            .values()
+            .all(|complete| !complete)
+    );
+    assert!(initial.outputs.is_empty());
+    assert!(
+        std::fs::read_to_string(initial.inventory)
+            .unwrap()
+            .contains(&orphan)
+    );
+}
+
+#[tokio::test]
+async fn cancelled_waiter_keeps_attempt_locked_until_blocking_worker_finishes() {
+    let (_root, mut input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let scratch = input.persist();
+    let packs = input.packs.clone();
+    let refs = input.refs.clone();
+    let (started_tx, started_rx) = tokio::sync::oneshot::channel();
+    let (done_tx, done_rx) = tokio::sync::oneshot::channel();
+    let (release_tx, release_rx) = std::sync::mpsc::channel();
+    let waiter = tokio::spawn(async move {
+        tokio::task::spawn_blocking(move || {
+            started_tx.send(()).unwrap();
+            release_rx.recv().unwrap();
+            drop(input);
+            done_tx.send(()).unwrap();
+        })
+        .await
+        .unwrap();
+    });
+    started_rx.await.unwrap();
+    waiter.abort();
+    assert!(
+        crate::maintenance_input::reopen(scratch.clone(), packs.clone(), refs.clone())
+            .await
+            .is_err()
+    );
+    release_tx.send(()).unwrap();
+    done_rx.await.unwrap();
+    let reopened = crate::maintenance_input::reopen(scratch.clone(), packs, refs)
+        .await
+        .unwrap();
+    drop(reopened);
+    std::fs::remove_dir_all(scratch).unwrap();
+}
+
+#[tokio::test]
+async fn ordinary_mixed_type_code_pack_is_classified_without_a_single_pack_rewrite() {
+    let (_root, mut input, _, _) = fixture(ObjectFormat::Sha1).await;
+    for reference in &mut input.refs.refs {
+        if reference.name.starts_with("refs/meta/") {
+            reference.name = reference.name.replacen("refs/meta/", "refs/heads/", 1);
+        }
+    }
+    let selected = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let mut refs = RefsConfig::default();
+    refs.packfiles.remove("meta");
+    refs.packfiles.get_mut("code").unwrap().include = vec![
+        "refs/heads/*".into(),
+        "refs/tags/*".into(),
+        "refs/meta/*".into(),
+    ];
+    let planned = plan(input, selected, refs, resources()).await.unwrap();
+    let (planned, classification) = classify(planned).await.unwrap();
+    let code = classification
+        .packs
+        .iter()
+        .find(|p| p.groups == ["code"])
+        .unwrap();
+    assert_eq!(code.kind, PackKind::Objects);
+    assert!(!code.mixed);
+    assert_eq!(code.audience, Some(PackGroupKind::Code));
+    assert_eq!(classification.group_complete.get("code"), Some(&true));
+    assert!(planned.outputs.is_empty());
+    assert!(planned.families.iter().all(|f| !f.completed));
+}
+
+#[tokio::test]
+async fn identical_code_meta_families_share_membership_and_settle() {
+    let (root, mut input, _, _) = fixture(ObjectFormat::Sha1).await;
+    let main = input
+        .refs
+        .refs
+        .iter()
+        .find(|r| r.name == "refs/heads/main")
+        .unwrap()
+        .oid
+        .clone();
+    input.refs.refs.push(Ref {
+        name: "refs/meta/shared".into(),
+        oid: main,
+        peeled: String::new(),
+    });
+    let mut refs = RefsConfig::default();
+    refs.packfiles.get_mut("code").unwrap().include = vec!["refs/heads/main".into()];
+    refs.packfiles.get_mut("meta").unwrap().include = vec!["refs/meta/shared".into()];
+    let segmented = segment(input, refs.clone(), PacksConfig::default(), resources())
+        .await
+        .unwrap();
+    let code_hashes: Vec<_> = segmented
+        .outputs
+        .iter()
+        .filter(|o| o.group == "code")
+        .map(|o| &o.pack.checksum)
+        .collect();
+    assert!(
+        segmented
+            .outputs
+            .iter()
+            .any(|o| o.group == "meta" && code_hashes.contains(&&o.pack.checksum))
+    );
+    let source = LocalRepo::init(
+        &root.path().join("dedup"),
+        &RepoId::new("fixture", "source").unwrap(),
+        ObjectFormat::Sha1,
+    )
+    .unwrap();
+    let mut unique = std::collections::BTreeMap::new();
+    for output in &segmented.outputs {
+        if unique
+            .insert(output.pack.checksum.clone(), output.pack.clone())
+            .is_some()
+        {
+            continue;
+        }
+        for ext in ["pack", "idx", "rev"] {
+            let path = output.path.with_extension(ext);
+            if path.exists() {
+                std::fs::copy(
+                    &path,
+                    source
+                        .path()
+                        .join("objects/pack")
+                        .join(path.file_name().unwrap()),
+                )
+                .unwrap();
+            }
+        }
+    }
+    let input = crate::maintenance_input::prepare(
+        source.path().to_path_buf(),
+        root.path().join("reclassify"),
+        unique.into_values().collect(),
+        segmented.input.refs.clone(),
+        (),
+    )
+    .await
+    .unwrap();
+    let checksums = input.packs.iter().map(|p| p.checksum.clone()).collect();
+    let planned = plan(input, checksums, refs, resources()).await.unwrap();
+    let (planned, classification) = classify(planned).await.unwrap();
+    assert!(classification.packs.iter().all(|p| !p.mixed));
+    let shared: Vec<_> = classification
+        .packs
+        .iter()
+        .filter(|p| p.groups.contains(&"code".into()) && p.groups.contains(&"meta".into()))
+        .collect();
+    assert!(!shared.is_empty());
+    assert!(
+        shared
+            .iter()
+            .all(|p| p.audience == Some(PackGroupKind::Code))
+    );
+    assert_eq!(classification.group_complete.get("code"), Some(&true));
+    assert_eq!(classification.group_complete.get("meta"), Some(&true));
+    assert!(planned.outputs.is_empty());
+}
diff --git a/crates/walgit-git/src/packfile_uri.rs b/crates/walgit-git/src/packfile_uri.rs
new file mode 100644
index 0000000..a12fed7
--- /dev/null
+++ b/crates/walgit-git/src/packfile_uri.rs
@@ -0,0 +1,319 @@
+//! Native v2 response framing. Coverage authority belongs to the caller; this
+//! module makes subtraction and URL emission one operation on the native engine.
+use std::collections::HashSet;
+use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
+
+use crate::{GitError, LocalRepo, ObjectId, UploadPackRequest, pkt};
+
+#[derive(Debug, Clone)]
+pub struct PackfileUri {
+    pub checksum: ObjectId,
+    pub url: String,
+    pub index: Option<IndexUri>,
+}
+
+#[derive(Debug, Clone)]
+pub struct IndexUri {
+    pub checksum: ObjectId,
+    pub url: String,
+}
+
+/// Every root must have exact captured coverage in the complete offered pack set.
+/// This transport type does not prove that graph obligation or authorize a URL.
+#[derive(Debug, Clone)]
+pub struct Selection {
+    pub packs: Vec<PackfileUri>,
+    pub roots: Vec<ObjectId>,
+}
+
+impl LocalRepo {
+    /// Use only after native-engine dispatch and exact group/dependency selection.
+    /// Have-only negotiation, shallow requests and unsupported filters stay dynamic.
+    pub async fn upload_pack_with_uris<W: AsyncWrite + Unpin + Send>(
+        &self,
+        mut request: UploadPackRequest,
+        selection: &Selection,
+        mut writer: W,
+    ) -> Result<(), GitError> {
+        if selection.packs.is_empty()
+            || selection.roots.is_empty()
+            || request.wants.is_empty()
+            || !request.done
+            || !request.shallow.is_empty()
+            || request.deepen.is_some()
+            || request.deepen_since.is_some()
+            || !request.deepen_not.is_empty()
+            || request.filter.as_deref().is_some_and(|f| f != "blob:none")
+        {
+            return Err(GitError::InvalidInput(
+                "URI selection requires a complete supported fetch".into(),
+            ));
+        }
+        for pack in &selection.packs {
+            let protocol = pack.url.split_once("://").map(|(p, _)| p);
+            if pack.checksum.kind() != self.object_format().kind()
+                || !matches!(protocol, Some("http" | "https"))
+                || !request
+                    .packfile_uris_protocols
+                    .iter()
+                    .any(|p| Some(p.as_str()) == protocol)
+                || pack
+                    .url
+                    .bytes()
+                    .any(|b| b.is_ascii_control() || b.is_ascii_whitespace())
+                || pack.url.len() + pack.checksum.kind().len_in_hex() + 3 > pkt::MAX_PKT_DATA
+            {
+                return Err(GitError::InvalidInput(
+                    "invalid or unnegotiated packfile URI".into(),
+                ));
+            }
+            if let Some(index) = &pack.index
+                && (!request.packfile_indexes
+                    || index.checksum.kind() != pack.checksum.kind()
+                    || !index
+                        .url
+                        .starts_with(&format!("{}://", protocol.unwrap_or_default()))
+                    || index
+                        .url
+                        .bytes()
+                        .any(|b| b.is_ascii_control() || b.is_ascii_whitespace())
+                    || index.url.len() + 2 * pack.checksum.kind().len_in_hex() + 4
+                        > pkt::MAX_PKT_DATA)
+            {
+                return Err(GitError::InvalidInput(
+                    "invalid or unnegotiated index URI".into(),
+                ));
+            }
+        }
+        if selection
+            .roots
+            .iter()
+            .any(|id| id.kind() != self.object_format().kind())
+        {
+            return Err(GitError::InvalidInput(
+                "URI root object format mismatch".into(),
+            ));
+        }
+        let real: HashSet<_> = request.haves.iter().copied().collect();
+        let synthetic: HashSet<_> = selection
+            .roots
+            .iter()
+            .filter(|id| !real.contains(*id))
+            .map(ToString::to_string)
+            .collect();
+        for root in &selection.roots {
+            if !request.haves.contains(root) {
+                request.haves.push(*root);
+            }
+        }
+        // Static packs are not installed yet when the client indexes this stream.
+        request.thin_pack = false;
+        // Upstream must not independently select packs outside our proof.
+        request.packfile_uris_protocols.clear();
+        request.packfile_indexes = false;
+        let body = crate::build_v2_fetch_request(&request);
+        let (mut source, sink) = tokio::io::duplex(64 * 1024);
+        let native = self.upload_pack_raw(pkt::Protocol::V2, &body[..], sink);
+        let splice = splice(
+            &mut source,
+            &mut writer,
+            &selection.packs,
+            &synthetic,
+            request.sideband_all,
+        );
+        tokio::try_join!(native, splice)?;
+        Ok(())
+    }
+}
+
+async fn line<W: AsyncWrite + Unpin>(
+    writer: &mut W,
+    data: &[u8],
+    sideband: bool,
+) -> Result<(), GitError> {
+    if sideband {
+        let mut payload = Vec::with_capacity(data.len() + 1);
+        payload.push(1);
+        payload.extend_from_slice(data);
+        pkt::write_pkt_line(writer, &payload).await
+    } else {
+        pkt::write_pkt_line(writer, data).await
+    }
+}
+
+async fn splice<R: AsyncRead + Unpin, W: AsyncWrite + Unpin>(
+    source: &mut R,
+    writer: &mut W,
+    packs: &[PackfileUri],
+    synthetic: &HashSet<String>,
+    sideband: bool,
+) -> Result<(), GitError> {
+    while let Some(packet) = pkt::read_pkt_line(source).await? {
+        match packet {
+            pkt::PktLine::Data(data) => {
+                let payload = if sideband {
+                    match data.split_first() {
+                        Some((1, rest)) => rest,
+                        Some((2 | 3, _)) => {
+                            pkt::write_pkt_line(writer, &data).await?;
+                            continue;
+                        }
+                        _ => return Err(GitError::Protocol("invalid response sideband".into())),
+                    }
+                } else {
+                    &data[..]
+                };
+                if let Some(ack) = payload.strip_prefix(b"ACK ")
+                    && std::str::from_utf8(ack).is_ok_and(|oid| synthetic.contains(oid.trim_end()))
+                {
+                    continue;
+                }
+                if payload == b"packfile\n" {
+                    line(writer, b"packfile-uris\n", sideband).await?;
+                    for pack in packs {
+                        line(
+                            writer,
+                            format!("{} {}\n", pack.checksum, pack.url).as_bytes(),
+                            sideband,
+                        )
+                        .await?;
+                    }
+                    pkt::write_delim(writer).await?;
+                    if packs.iter().any(|p| p.index.is_some()) {
+                        line(writer, b"packfile-indexes\n", sideband).await?;
+                        for pack in packs {
+                            if let Some(index) = &pack.index {
+                                line(
+                                    writer,
+                                    format!("{} {} {}\n", pack.checksum, index.checksum, index.url)
+                                        .as_bytes(),
+                                    sideband,
+                                )
+                                .await?;
+                            }
+                        }
+                        pkt::write_delim(writer).await?;
+                    }
+                    pkt::write_pkt_line(writer, &data).await?;
+                    // Pack bytes already have their native sideband framing.
+                    tokio::io::copy(source, writer).await?;
+                    writer.flush().await?;
+                    return Ok(());
+                }
+                pkt::write_pkt_line(writer, &data).await?;
+            }
+            pkt::PktLine::Delim => pkt::write_delim(writer).await?,
+            pkt::PktLine::Flush | pkt::PktLine::ResponseEnd => {
+                return Err(GitError::Protocol(
+                    "native response ended without selected URI delivery".into(),
+                ));
+            }
+        }
+    }
+    Err(GitError::Protocol(
+        "truncated native response before packfile".into(),
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn splice_preserves_native_bytes_and_only_removes_synthetic_acknowledgements() {
+        for sideband in [false, true] {
+            let oid = ObjectId::from_hex(b"1111111111111111111111111111111111111111").unwrap();
+            let packs = [PackfileUri {
+                checksum: oid,
+                url: "https://example.invalid/repo/packfiles/one.pack".into(),
+                index: None,
+            }];
+            let mut input = Vec::new();
+            for data in [
+                "acknowledgments\n",
+                "ACK 1111111111111111111111111111111111111111\n",
+                "ACK 2222222222222222222222222222222222222222\n",
+                "ready\n",
+            ] {
+                line(&mut input, data.as_bytes(), sideband).await.unwrap();
+            }
+            pkt::encode_delim(&mut input);
+            line(&mut input, b"packfile\n", sideband).await.unwrap();
+            let mut pack_bytes = Vec::new();
+            pkt::encode_data(&mut pack_bytes, b"\x01PACK\0\xff\n");
+            pkt::encode_flush(&mut pack_bytes);
+            input.extend_from_slice(&pack_bytes);
+            let mut output = Vec::new();
+            splice(
+                &mut &input[..],
+                &mut output,
+                &packs,
+                &HashSet::from([oid.to_string()]),
+                sideband,
+            )
+            .await
+            .unwrap();
+            assert!(output.ends_with(&pack_bytes));
+            let text = String::from_utf8_lossy(&output);
+            assert!(!text.contains("ACK 111111"));
+            assert!(text.contains("ACK 222222"));
+            assert!(text.find("packfile-uris\n").unwrap() < text.find("packfile\n").unwrap());
+        }
+    }
+
+    #[tokio::test]
+    async fn no_pack_or_truncated_response_cannot_satisfy_uri_delivery() {
+        for data in [b"0000".as_slice(), b"0002", b"000", b""] {
+            assert!(
+                splice(&mut &data[..], &mut Vec::new(), &[], &HashSet::new(), false)
+                    .await
+                    .is_err()
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn optional_indexes_are_delimited_between_uris_and_pack_data() {
+        let checksum = ObjectId::from_hex(b"1111111111111111111111111111111111111111").unwrap();
+        let index_hash = ObjectId::from_hex(b"2222222222222222222222222222222222222222").unwrap();
+        let packs = [PackfileUri {
+            checksum,
+            url: "https://example.invalid/one.pack".into(),
+            index: Some(IndexUri {
+                checksum: index_hash,
+                url: "https://example.invalid/one.idx".into(),
+            }),
+        }];
+        let mut source = Vec::new();
+        line(&mut source, b"packfile\n", true).await.unwrap();
+        pkt::encode_data(&mut source, b"\x01PACK");
+        pkt::encode_flush(&mut source);
+        let mut output = Vec::new();
+        splice(&mut &source[..], &mut output, &packs, &HashSet::new(), true)
+            .await
+            .unwrap();
+        let mut expected = Vec::new();
+        line(&mut expected, b"packfile-uris\n", true).await.unwrap();
+        line(
+            &mut expected,
+            format!("{checksum} https://example.invalid/one.pack\n").as_bytes(),
+            true,
+        )
+        .await
+        .unwrap();
+        pkt::encode_delim(&mut expected);
+        line(&mut expected, b"packfile-indexes\n", true)
+            .await
+            .unwrap();
+        line(
+            &mut expected,
+            format!("{checksum} {index_hash} https://example.invalid/one.idx\n").as_bytes(),
+            true,
+        )
+        .await
+        .unwrap();
+        pkt::encode_delim(&mut expected);
+        expected.extend_from_slice(&source);
+        assert_eq!(output, expected);
+    }
+}
diff --git a/crates/walgit-git/src/pkt.rs b/crates/walgit-git/src/pkt.rs
index 5db7944..ab7c3a8 100644
--- a/crates/walgit-git/src/pkt.rs
+++ b/crates/walgit-git/src/pkt.rs
@@ -270,6 +270,9 @@ pub async fn read_command<R: AsyncRead + Unpin>(mut r: R) -> Result<(V2Command,
                     cmd.name = rest.to_string();
                     saw_name = true;
                 } else if let Some((k, v)) = s.split_once('=') {
+                    if k == "server-option" {
+                        cmd.args.push(s.clone());
+                    }
                     cmd.caps.insert(k.to_string(), v.to_string());
                 } else {
                     // Could be a capability ("thin-pack") or a positional arg.
@@ -368,9 +371,6 @@ pub fn parse_object_info(cmd: &V2Command) -> ObjectInfoRequest {
     req
 }
 
-/// `bundle-uri` has no arguments in v2.
-pub fn parse_bundle_uri(_cmd: &V2Command) {}
-
 fn io_to_git(e: std::io::Error) -> GitError {
     GitError::Io(e)
 }
diff --git a/crates/walgit-git/src/upload_gix.rs b/crates/walgit-git/src/upload_gix.rs
index 3171854..37bc053 100644
--- a/crates/walgit-git/src/upload_gix.rs
+++ b/crates/walgit-git/src/upload_gix.rs
@@ -190,65 +190,6 @@ impl LocalRepo {
         Ok(stats)
     }
 
-    /// A git bundle (`# v2 git bundle` header with `refs` and `-<prereq>`
-    /// lines, then the pack) written with this engine: the pack is exactly
-    /// "objects reachable from `refs` minus `prerequisites`", enumerated by
-    /// tree diff, so incremental bundles of a repository whose base is
-    /// linked/remote-served never walk the base's trees (stock `git bundle
-    /// create` marks every tree of the boundary commits uninteresting = reads
-    /// them all). `refs` are `(name, oid)`; prerequisites are commit ids the
-    /// consumer must already have. Returns the pack's object count and bytes.
-    pub async fn write_bundle_gix<W: AsyncWrite + Unpin + Send>(
-        &self,
-        mut out: W,
-        refs: &[(String, gix_hash::ObjectId)],
-        prerequisites: &[gix_hash::ObjectId],
-        faulter: Option<&dyn ObjectFaulter>,
-    ) -> Result<UploadPackStats, GitError> {
-        let mut header = String::from("# v2 git bundle\n");
-        for p in prerequisites {
-            {
-                let _ = std::fmt::Write::write_fmt(&mut header, format_args!("-{} \n", p.to_hex()));
-            };
-        }
-        for (name, oid) in refs {
-            {
-                let _ = std::fmt::Write::write_fmt(
-                    &mut header,
-                    format_args!("{} {name}\n", oid.to_hex()),
-                );
-            };
-        }
-        header.push('\n');
-        out.write_all(header.as_bytes())
-            .await
-            .map_err(GitError::Io)?;
-        let req = UploadPackRequest {
-            wants: refs.iter().map(|(_, o)| *o).collect(),
-            haves: prerequisites.to_vec(),
-            done: true,
-            thin_pack: false,
-            no_progress: true,
-            include_tag: false,
-            ofs_delta: true,
-            sideband_all: false,
-            wait_for_done: false,
-            filter: None,
-            deepen: None,
-            deepen_since: None,
-            deepen_not: vec![],
-            shallow: vec![],
-            want_refs: vec![],
-            packfile_uris_protocols: vec![],
-        };
-        // Prerequisites are known by definition (the bundle's consumer has them).
-        let common: Vec<gix_hash::ObjectId> = prerequisites.to_vec();
-        let mut sink = PackOut::Raw(out);
-        let stats = self.produce_pack(&req, &common, faulter, &mut sink).await?;
-        sink.finish().await?;
-        Ok(stats)
-    }
-
     /// Enumerate (retrying after faults) and stream the pack into `sink`.
     async fn produce_pack<W: AsyncWrite + Unpin + Send>(
         &self,
@@ -476,7 +417,6 @@ enum PackOut<W: AsyncWrite + Unpin + Send> {
         sb_all: bool,
         progress: bool,
     },
-    Raw(W),
 }
 
 impl<W: AsyncWrite + Unpin + Send> PackOut<W> {
@@ -488,13 +428,11 @@ impl<W: AsyncWrite + Unpin + Send> PackOut<W> {
                 let _ = sb.write_progress(text.as_bytes()).await;
             }
             PackOut::Sideband { .. } => {}
-            PackOut::Raw(_) => {
-                tracing::debug!(target: "walgit_git::upload_gix", "{}", text.trim_end());
-            }
         }
     }
     async fn begin_pack(&mut self) -> Result<(), GitError> {
-        if let PackOut::Sideband { sb, sb_all, .. } = self {
+        let PackOut::Sideband { sb, sb_all, .. } = self;
+        {
             let mut pf = Vec::with_capacity(16);
             line(&mut pf, b"packfile\n", *sb_all);
             sb.inner_mut().write_all(&pf).await.map_err(GitError::Io)?;
@@ -504,13 +442,11 @@ impl<W: AsyncWrite + Unpin + Send> PackOut<W> {
     async fn data(&mut self, chunk: &[u8]) -> Result<(), GitError> {
         match self {
             PackOut::Sideband { sb, .. } => sb.write_data(chunk).await,
-            PackOut::Raw(w) => w.write_all(chunk).await.map_err(GitError::Io),
         }
     }
     async fn finish(&mut self) -> Result<(), GitError> {
         match self {
             PackOut::Sideband { sb, .. } => sb.flush().await,
-            PackOut::Raw(w) => w.flush().await.map_err(GitError::Io),
         }
     }
 }
diff --git a/crates/walgit-git/tests/common/mod.rs b/crates/walgit-git/tests/common/mod.rs
index 2032fad..10b2656 100644
--- a/crates/walgit-git/tests/common/mod.rs
+++ b/crates/walgit-git/tests/common/mod.rs
@@ -31,9 +31,21 @@ pub fn cursor(b: Vec<u8>) -> std::io::Cursor<Vec<u8>> {
 impl SourceRepo {
     /// Create a source repo with one initial commit (`file1`).
     pub fn new() -> Self {
+        Self::with_object_format("sha1")
+    }
+
+    pub fn with_object_format(format: &str) -> Self {
         let tmp = TempDir::new().expect("tmpdir");
         let dir = tmp.path().to_path_buf();
-        run_git(&dir, &["init", "-q", dir.to_str().unwrap()]);
+        run_git(
+            &dir,
+            &[
+                "init",
+                "-q",
+                &format!("--object-format={format}"),
+                dir.to_str().unwrap(),
+            ],
+        );
         run_git(&dir, &["config", "user.email", "t@t"]);
         run_git(&dir, &["config", "user.name", "t"]);
         run_git(&dir, &["config", "commit.gpgsign", "false"]);
diff --git a/crates/walgit-git/tests/ls_refs.rs b/crates/walgit-git/tests/ls_refs.rs
index 4f09d90..a069202 100644
--- a/crates/walgit-git/tests/ls_refs.rs
+++ b/crates/walgit-git/tests/ls_refs.rs
@@ -206,7 +206,7 @@ fn bench_ls_refs_466k() {
     let ls_elapsed = start.elapsed();
     let mut advert = Vec::new();
     let start = Instant::now();
-    repo.advertise_refs_v0(walgit_git::Service::UploadPack, &mut advert)
+    repo.advertise_refs_v0(walgit_git::Service::UploadPack, &mut advert, None)
         .unwrap();
     let advert_elapsed = start.elapsed();
     let rss_kib = std::fs::read_to_string("/proc/self/status")
diff --git a/crates/walgit-git/tests/midx.rs b/crates/walgit-git/tests/midx.rs
new file mode 100644
index 0000000..67b01b0
--- /dev/null
+++ b/crates/walgit-git/tests/midx.rs
@@ -0,0 +1,77 @@
+#![allow(clippy::unwrap_used)]
+#[path = "common/mod.rs"]
+mod common;
+
+use walgit_git::{IngestOptions, LocalRepo, ObjectFormat, RepoId};
+
+#[tokio::test]
+async fn verifies_real_multi_pack_bitmap_and_rejects_missing_or_corrupt_bytes() {
+    for format in [ObjectFormat::Sha1, ObjectFormat::Sha256] {
+        let source = common::SourceRepo::with_object_format(match format {
+            ObjectFormat::Sha1 => "sha1",
+            ObjectFormat::Sha256 => "sha256",
+        });
+        let first = source.head();
+        let root = tempfile::tempdir().unwrap();
+        let repo =
+            LocalRepo::init(root.path(), &RepoId::new("test", "bitmap").unwrap(), format).unwrap();
+        let mut packs = Vec::new();
+        for step in 0..2 {
+            if step == 1 {
+                source.commit_file("nested/next", "next", "next");
+            }
+            let excludes = if step == 0 {
+                vec![]
+            } else {
+                vec![first.as_str()]
+            };
+            let pack = repo
+                .ingest_pack(
+                    common::cursor(source.pack(&["HEAD"], &excludes, false)),
+                    IngestOptions {
+                        fsck: true,
+                        thin: false,
+                        max_bytes: None,
+                    },
+                )
+                .await
+                .unwrap()
+                .unwrap();
+            packs.push(pack.checksum);
+        }
+        let commit = source.head();
+        common::run_git(repo.path(), &["update-ref", "refs/heads/main", &commit]);
+        common::run_git(repo.path(), &["symbolic-ref", "HEAD", "refs/heads/main"]);
+        let verified = repo
+            .write_verified_midx(&packs, commit.parse().unwrap(), ())
+            .await
+            .unwrap();
+        assert!(verified.bitmap_path.is_file());
+        assert_eq!(
+            common::run_git(repo.path(), &["config", "pack.allowPackReuse"]).trim(),
+            "multi"
+        );
+        common::run_git(repo.path(), &["fsck", "--strict"]);
+        let bytes = std::fs::read(&verified.bitmap_path).unwrap();
+        std::fs::remove_file(&verified.bitmap_path).unwrap();
+        assert!(walgit_git::midx::verify_files(&repo).is_err());
+        let mut corrupt = bytes.clone();
+        *corrupt.last_mut().unwrap() ^= 1;
+        std::fs::write(&verified.bitmap_path, corrupt).unwrap();
+        assert!(walgit_git::midx::verify_files(&repo).is_err());
+        std::fs::write(&verified.bitmap_path, bytes).unwrap();
+        assert_eq!(
+            walgit_git::midx::verify_files(&repo).unwrap().checksum,
+            verified.checksum
+        );
+        repo.set_segmented_midx_mode(true);
+        repo.write_history_midx().await.unwrap();
+        assert!(
+            walgit_git::midx::verify_files(&repo).is_ok(),
+            "old history helper must not erase the full bitmap"
+        );
+        repo.remove_pack(packs.first().unwrap()).unwrap();
+        assert!(!repo.path().join("objects/pack/multi-pack-index").exists());
+        assert!(!verified.bitmap_path.exists());
+    }
+}
diff --git a/crates/walgit-git/tests/pack_groups.rs b/crates/walgit-git/tests/pack_groups.rs
new file mode 100644
index 0000000..ff11049
--- /dev/null
+++ b/crates/walgit-git/tests/pack_groups.rs
@@ -0,0 +1,88 @@
+#![allow(clippy::unwrap_used, clippy::indexing_slicing)]
+#[path = "common/mod.rs"]
+mod common;
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::Write;
+use std::process::{Command, Stdio};
+use walgit_config::{PackGroupConfig, PackGroupKind, RefsConfig};
+use walgit_git::{Ref, RefSnapshotData, pack_groups::resolve_groups};
+
+#[test]
+fn dependency_packs_reconstruct_captured_tags_without_metadata() {
+    let source = common::SourceRepo::new();
+    let a = source.head();
+    let b = source.commit_file("nested/file", "second", "second");
+    let c = source.commit_file("nested/file", "third", "third");
+    let tag = source.annotated_tag("release", &c);
+    let meta = source.commit_file("metadata-only", "not code", "metadata");
+    let snapshot = RefSnapshotData {
+        refs: [
+            ("refs/heads/base", a),
+            ("refs/heads/middle", b),
+            ("refs/tags/release", tag.clone()),
+            ("refs/meta/state", meta.clone()),
+        ]
+        .into_iter()
+        .map(|(name, oid)| Ref {
+            name: name.into(),
+            oid,
+            peeled: String::new(),
+        })
+        .collect(),
+        head_target: "refs/heads/base".into(),
+    };
+    let group = |include: &str, subtract: &[&str]| PackGroupConfig {
+        kind: PackGroupKind::Code,
+        include: vec![include.into()],
+        subtract: subtract.iter().map(|s| (*s).into()).collect(),
+    };
+    let mut config = RefsConfig {
+        advertise: vec![],
+        packfiles: BTreeMap::from([
+            ("base".into(), group("HEAD", &[])),
+            ("middle".into(), group("refs/heads/middle", &["base"])),
+            ("release".into(), group("refs/tags/*", &["middle"])),
+        ]),
+    };
+    let groups = resolve_groups(&config, &snapshot).unwrap();
+    assert_eq!(groups["release"].dependencies, ["base", "middle"]);
+    config.advertise = vec!["refs/meta/*".into()];
+    assert_eq!(groups, resolve_groups(&config, &snapshot).unwrap());
+    let target = common::fresh_bare();
+    for name in ["base", "middle", "release"] {
+        let roots = &groups[name];
+        let bytes = source.pack(
+            &roots.include.iter().map(String::as_str).collect::<Vec<_>>(),
+            &roots.exclude.iter().map(String::as_str).collect::<Vec<_>>(),
+            false,
+        );
+        let mut child = Command::new("git")
+            .current_dir(target.path())
+            .args(["index-pack", "--stdin"])
+            .stdin(Stdio::piped())
+            .stdout(Stdio::null())
+            .spawn()
+            .unwrap();
+        child.stdin.take().unwrap().write_all(&bytes).unwrap();
+        assert!(child.wait().unwrap().success());
+    }
+    common::run_git(target.path(), &["update-ref", "refs/tags/release", &tag]);
+    common::run_git(target.path(), &["fsck", "--strict"]);
+    let inventory = |dir: &std::path::Path, rev: &str| -> BTreeSet<String> {
+        common::run_git(dir, &["rev-list", "--objects", rev])
+            .lines()
+            .map(|line| line.split_whitespace().next().unwrap().to_owned())
+            .collect()
+    };
+    assert_eq!(inventory(target.path(), &tag), inventory(&source.dir, &tag));
+    assert!(
+        !Command::new("git")
+            .current_dir(target.path())
+            .args(["cat-file", "-e", &meta])
+            .stderr(Stdio::null())
+            .status()
+            .unwrap()
+            .success()
+    );
+}
diff --git a/crates/walgit-git/tests/upload_gix_remote.rs b/crates/walgit-git/tests/upload_gix_remote.rs
index e65e0fc..a957356 100644
--- a/crates/walgit-git/tests/upload_gix_remote.rs
+++ b/crates/walgit-git/tests/upload_gix_remote.rs
@@ -108,6 +108,7 @@ fn req(
         shallow: vec![],
         want_refs: vec![],
         packfile_uris_protocols: vec![],
+        packfile_indexes: false,
     }
 }
 
diff --git a/crates/walgit-git/tests/upload_gix_scale.rs b/crates/walgit-git/tests/upload_gix_scale.rs
index e1b9f10..913a1df 100644
--- a/crates/walgit-git/tests/upload_gix_scale.rs
+++ b/crates/walgit-git/tests/upload_gix_scale.rs
@@ -235,6 +235,7 @@ fn req(
         shallow: vec![],
         want_refs: vec![],
         packfile_uris_protocols: vec![],
+        packfile_indexes: false,
     }
 }
 
diff --git a/crates/walgit-git/tests/upload_pack.rs b/crates/walgit-git/tests/upload_pack.rs
index ab875d8..03d0757 100644
--- a/crates/walgit-git/tests/upload_pack.rs
+++ b/crates/walgit-git/tests/upload_pack.rs
@@ -130,6 +130,7 @@ async fn fetch_no_haves_produces_valid_pack() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         assert!(!resp.is_empty(), "empty response for {engine:?}");
@@ -172,6 +173,7 @@ async fn fetch_with_haves_smaller_pack_and_ack() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let req_ack = UploadPackRequest {
             wants: vec![oid(&b)],
@@ -223,6 +225,7 @@ async fn fetch_filter_blob_none_no_blobs() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         let pack = cm::extract_packfile(&resp);
@@ -288,6 +291,7 @@ async fn fetch_filter_blob_limit_excludes_large_blobs() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         let pack = cm::extract_packfile(&resp);
@@ -324,6 +328,7 @@ async fn fetch_filter_tree_0_only_root_tree() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         let pack = cm::extract_packfile(&resp);
@@ -401,6 +406,7 @@ async fn fetch_include_tag_sends_annotated_tag() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         let pack = cm::extract_packfile(&resp);
@@ -473,6 +479,7 @@ async fn fetch_deepen_shallow_info() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, engine, &req).await;
         // For gix engine: check shallow-info section is present.
@@ -515,6 +522,7 @@ async fn fetch_haves_shrink_pack() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         // Incremental fetch (have A, want B).
         let req_inc = UploadPackRequest {
@@ -560,6 +568,7 @@ async fn fetch_fsck_rejects_corrupt_pack() {
         shallow: vec![],
         want_refs: vec![],
         packfile_uris_protocols: vec![],
+        packfile_indexes: false,
     };
     let resp = run_fetch(&repo, Engine::Gix, &req).await;
     let pack = cm::extract_packfile(&resp);
@@ -656,6 +665,7 @@ async fn fetch_skips_gitlink_entries() {
             shallow: vec![],
             want_refs: vec![],
             packfile_uris_protocols: vec![],
+            packfile_indexes: false,
         };
         let resp = run_fetch(&repo, Engine::Gix, &req).await;
         let pack = cm::extract_packfile(&resp);
@@ -795,6 +805,7 @@ async fn bench_fetch_engines() {
         shallow: vec![],
         want_refs: vec![],
         packfile_uris_protocols: vec![],
+        packfile_indexes: false,
     };
     for (label, req) in [
         (
diff --git a/crates/walgit-proto/Cargo.toml b/crates/walgit-proto/Cargo.toml
index 35afed4..9d3ebbb 100644
--- a/crates/walgit-proto/Cargo.toml
+++ b/crates/walgit-proto/Cargo.toml
@@ -5,6 +5,9 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
+anyhow.workspace = true
+sha2.workspace = true
+hex.workspace = true
 prost.workspace = true
 bytes.workspace = true
 prost-types.workspace = true
diff --git a/crates/walgit-proto/proto/walgit/v1/wal.proto b/crates/walgit-proto/proto/walgit/v1/wal.proto
index 9da1199..e88cf43 100644
--- a/crates/walgit-proto/proto/walgit/v1/wal.proto
+++ b/crates/walgit-proto/proto/walgit/v1/wal.proto
@@ -15,17 +15,20 @@ import "google/protobuf/timestamp.proto";
 //   wal/<sha>.pack|.idx    immutable, content-addressed (pack checksum)
 //                          (+ .rev, .bitmap for compacted packs)
 //   checkpoints/<seq:016x>/checkpoint.pb   Checkpoint: pack set + ref snapshot ref
-//   checkpoints/<seq:016x>/refs.pb         RefSnapshot
-//   checkpoints/<seq:016x>/<sha>.bundle    optional git bundle rendered from it
-//   bundles/list.pb        BundleList (bundle-uri advertisement)
+//   checkpoints/refs/<sha256>.pb          canonical RefSnapshot
+//   checkpoints/<seq:016x>/attempts/<id>/checkpoint.pb  unique metadata candidate
+//   Older checkpoints/<seq:016x>/refs.pb and bundle objects remain decodable;
+//   bundle wrappers/lists are historical data, not active runtime delivery.
 //   leases/<name>.pb       Lease (CAS + TTL)
 //   lfs/objects/aa/bb/<oid>
 //
-// Everything except manifest.pb, bundles/list.pb and leases/* is immutable.
+// Packs/snapshots/logs are immutable; manifests, leases and documented control
+// objects are mutable. Historical bundle formats below remain replayable.
 // ---------------------------------------------------------------------------
 
 message Manifest {
-  // Bumped only on incompatible layout changes. Readers reject unknown values.
+  // Format marker. New readers reject unknown values; deployed older readers
+  // do not enforce this gate and must be excluded during authority cutovers.
   uint32 format_version = 1;
   // "<owner>/<repo>"
   string repo = 2;
@@ -54,10 +57,12 @@ message Manifest {
   // refs-level sync must see the effective config without another GET; the
   // document is small (validated <= 16 KiB). History = SETTINGS log entries.
   RepoSettings settings = 12;
+  // Exact committed download history; no time or count expiry.
+  repeated RetiredPack retired_packs = 13;
 }
 
 // D24: per-repository settings — a TOML document restricted to the sections a
-// repository may override (`bundles`, `maintenance`, `compaction`); the
+// repository may override (maintenance, compaction, upstream, refs, packfile_uri); the
 // effective configuration is the host's walgit.toml with this merged on top
 // (`Config::with_settings`). Validated at publish; invalid settings are
 // never published.
@@ -109,19 +114,49 @@ message PackRef {
   // commits is stored at wal/<checksum>.commit-graph. Written for tier-2 bases
   // so readers walk history without pack data.
   bool has_commit_graph = 9;
-  // What the pack holds. OBJECTS (default) = a normal pack. HISTORY = a
-  // derived pack of the base's commits + trees (`pack-objects --filter=blob:none`),
-  // published next to a tier-2 base so instances keep every history walk local
-  // while blob data stays in the base (linked / remote). `derived_from` names
-  // the base pack; a history pack never supersedes anything and is superseded
-  // together with its base.
+  // OBJECTS is an ordinary unsegmented pack. HISTORY can be an old redundant
+  // accelerator derived from a live base, or authoritative non-blob segment
+  // content. BLOBS segments hold blobs. The enum alone does not establish
+  // ownership, retirement safety or URI eligibility. Preserve exact descriptors.
   PackKind kind = 10;
+  // Producer/base provenance; not permission to discard authoritative content.
   string derived_from = 11;
+  // Provenance only; never a substitute for exact group coverage.
+  uint64 covers_seq = 12;
+  google.protobuf.Timestamp published_at = 13;
+  PackAudience audience = 14;
+  string ref_policy = 15;
+  repeated string pack_groups = 16;
+  repeated PackGroupCoverage group_coverages = 17;
+  string coverage_refs_key = 18;
 }
 
 enum PackKind {
   PACK_KIND_OBJECTS = 0;
   PACK_KIND_HISTORY = 1;
+  PACK_KIND_BLOBS = 2;
+}
+
+// Scope classification only. These labels do not authorize access or prove closure.
+enum PackAudience {
+  PACK_AUDIENCE_UNSPECIFIED = 0;
+  PACK_AUDIENCE_CODE = 1;
+  PACK_AUDIENCE_META = 2;
+  PACK_AUDIENCE_RETAINED = 3;
+}
+
+message RetiredPack {
+  string checksum = 1;
+  google.protobuf.Timestamp retired_at = 2;
+  uint64 retired_seq = 3;
+}
+
+message PackGroupCoverage {
+  string group = 1;
+  string ref_policy = 2;
+  uint64 covers_seq = 3;
+  repeated string packs = 4;
+  string refs_key = 5;
 }
 
 enum EntryKind {
@@ -187,7 +222,7 @@ message Checkpoint {
   // Key of the `RefSnapshot`, e.g. "checkpoints/<seq>/refs.pb".
   string refs_key = 4;
   uint64 ref_count = 5;
-  // Optional rendered full bundle for bundle-uri, e.g. "checkpoints/<seq>/<sha>.bundle".
+  // Historical optional wrapper; retained for replay, new writers leave empty.
   string bundle_key = 6;
   google.protobuf.Timestamp created_at = 7;
   string writer = 8;
@@ -201,13 +236,14 @@ message CheckpointRef {
   // fetching the checkpoint object).
   google.protobuf.Timestamp created_at = 3;
   // Earliest WAL state this repository ever had (carried forward from the
-  // previous checkpoint, else the first folded entry's `created_at`: bundle
-  // slots before it are "unavailable"; slots after it are backfillable even
-  // on a maintainer that cold-starts from this checkpoint (D22).
+  // previous checkpoint, else the first folded entry's `created_at`).
+  // Historical provenance, retained independently of removed bundle schedules.
   google.protobuf.Timestamp first_state_at = 4;
   // `created_at` of the newest entry this checkpoint folded: the state it holds
   // is the repository "as of" this instant (≠ `created_at`, the write time).
   google.protobuf.Timestamp as_of = 5;
+  // Exact committed snapshot pointer, empty on old checkpoints.
+  string refs_key = 6;
 }
 
 message RefSnapshot {
@@ -241,7 +277,7 @@ message Lease {
 }
 
 // ---------------------------------------------------------------------------
-// bundle-uri: bundles/list.pb
+// Historical bundle-uri formats: retained for decoding; no active runtime
 // ---------------------------------------------------------------------------
 
 message BundleList {
@@ -331,7 +367,7 @@ message RepoCatalog {
 
 // Maintainer heartbeat at `maintain/<host>.pb` (bucket root, not per repo):
 // who maintains what, with what capacity, and whether that host is alive.
-// `bundle plan` / the WAL page show the responsible host per repository.
+// The WAL page shows the responsible host per repository.
 message MaintainerHeartbeat {
   string host = 1;
   repeated string repos = 2;
diff --git a/crates/walgit-proto/src/inventory.rs b/crates/walgit-proto/src/inventory.rs
new file mode 100644
index 0000000..f089e5f
--- /dev/null
+++ b/crates/walgit-proto/src/inventory.rs
@@ -0,0 +1,77 @@
+//! Exact membership helpers. Retired inventory is download history, never live proof.
+use std::collections::BTreeSet;
+
+use crate::v1::{Manifest, RetiredPack};
+
+impl Manifest {
+    pub fn serves_pack(&self, checksum: &str) -> bool {
+        self.packs.iter().any(|p| p.checksum == checksum)
+            || self.retired_packs.iter().any(|p| p.checksum == checksum)
+    }
+
+    /// Record currently live members before removing them. Never expires or truncates history.
+    pub fn retire_packs(&mut self, checksums: &[String], seq: u64) {
+        self.retire_packs_at(checksums, seq, crate::time::now());
+    }
+
+    pub fn retire_packs_at(&mut self, checksums: &[String], seq: u64, at: prost_types::Timestamp) {
+        let requested: BTreeSet<_> = checksums.iter().collect();
+        let mut recorded: BTreeSet<_> = self
+            .retired_packs
+            .iter()
+            .map(|p| p.checksum.clone())
+            .collect();
+        for pack in &self.packs {
+            if requested.contains(&pack.checksum) && recorded.insert(pack.checksum.clone()) {
+                self.retired_packs.push(RetiredPack {
+                    checksum: pack.checksum.clone(),
+                    retired_seq: seq,
+                    retired_at: Some(at),
+                });
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::{
+        Message,
+        v1::{Manifest, PackRef},
+    };
+    #[test]
+    fn retirement_is_exact_deduplicated_and_survives_reencoding() {
+        let mut m = Manifest {
+            packs: vec![PackRef {
+                checksum: "a".repeat(40),
+                ..Default::default()
+            }],
+            ..Default::default()
+        };
+        m.retire_packs(&["a".repeat(40), "b".repeat(40)], 7);
+        m.retire_packs(&["a".repeat(40)], 9);
+        m.packs.clear();
+        let m = Manifest::decode(m.encode_to_vec().as_slice()).unwrap();
+        assert_eq!(m.retired_packs.len(), 1);
+        assert_eq!(m.retired_packs[0].retired_seq, 7);
+        assert!(m.serves_pack(&"a".repeat(40)));
+        assert!(!m.serves_pack(&"b".repeat(40)));
+    }
+    #[test]
+    fn old_wire_messages_keep_new_fields_empty() {
+        // Synthetic pre-extension wire bytes: format_version=1, object_format=sha1/sha256.
+        for format in ["sha1", "sha256"] {
+            let mut bytes = vec![8, 1, 26, u8::try_from(format.len()).unwrap()];
+            bytes.extend_from_slice(format.as_bytes());
+            let m = Manifest::decode(bytes.as_slice()).unwrap();
+            assert_eq!(m.object_format, format);
+            assert!(m.retired_packs.is_empty());
+            assert_eq!(m.encode_to_vec(), bytes);
+        }
+        let p = PackRef::decode(&[56, 7, 64, 2][..]).unwrap();
+        assert_eq!(p.seq, 7);
+        assert_eq!(p.tier, 2);
+        assert!(p.group_coverages.is_empty());
+        assert_eq!(p.audience, 0);
+    }
+}
diff --git a/crates/walgit-proto/src/lib.rs b/crates/walgit-proto/src/lib.rs
index 55c696d..769bcf8 100644
--- a/crates/walgit-proto/src/lib.rs
+++ b/crates/walgit-proto/src/lib.rs
@@ -9,6 +9,9 @@ pub mod v1 {
     include!(concat!(env!("OUT_DIR"), "/walgit.v1.rs"));
 }
 
+pub mod inventory;
+pub mod snapshot;
+
 pub use prost;
 pub use prost::Message;
 pub use prost_types;
@@ -70,6 +73,10 @@ pub mod keys {
     pub fn checkpoint_key(seq: u64) -> String {
         format!("{CHECKPOINTS_DIR}{seq:016x}/checkpoint.pb")
     }
+    /// Unique candidate metadata; attempt must be a caller-generated safe identifier.
+    pub fn checkpoint_attempt_key(seq: u64, attempt: &str) -> String {
+        format!("{CHECKPOINTS_DIR}{seq:016x}/attempts/{attempt}/checkpoint.pb")
+    }
     pub fn checkpoint_refs_key(seq: u64) -> String {
         format!("{CHECKPOINTS_DIR}{seq:016x}/refs.pb")
     }
diff --git a/crates/walgit-proto/src/snapshot.rs b/crates/walgit-proto/src/snapshot.rs
new file mode 100644
index 0000000..05b1cad
--- /dev/null
+++ b/crates/walgit-proto/src/snapshot.rs
@@ -0,0 +1,155 @@
+//! Canonical ref snapshots. Exact content keys are authority only after publication.
+use anyhow::{Result, ensure};
+use prost::Message;
+use sha2::{Digest, Sha256};
+
+use crate::v1::RefSnapshot;
+
+#[expect(
+    clippy::case_sensitive_file_extension_comparisons,
+    reason = "Git refname rules reject the case-sensitive .lock suffix"
+)]
+fn valid_ref(name: &str) -> bool {
+    name.starts_with("refs/")
+        && !name.ends_with('/')
+        && !name.ends_with('.')
+        && !name.contains("..")
+        && !name.contains("@{")
+        && !name
+            .bytes()
+            .any(|b| b <= b' ' || b == 127 || b"~^:?*[\\".contains(&b))
+        && name
+            .split('/')
+            .all(|p| !p.is_empty() && !p.starts_with('.') && !p.ends_with(".lock"))
+}
+
+fn valid_oid(oid: &str, len: usize) -> bool {
+    oid.len() == len
+        && oid
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+        && oid.bytes().any(|b| b != b'0')
+}
+
+/// Validate object format, ref names/OIDs, unique names and symbolic HEAD syntax.
+/// An unborn symbolic HEAD may name a ref absent from the snapshot.
+pub fn validate(snapshot: &RefSnapshot) -> Result<()> {
+    let oid_len = match snapshot.object_format.as_str() {
+        "sha1" => 40,
+        "sha256" => 64,
+        other => anyhow::bail!("unsupported snapshot object format {other:?}"),
+    };
+    ensure!(
+        snapshot.head_target.is_empty() || valid_ref(&snapshot.head_target),
+        "invalid snapshot symbolic HEAD"
+    );
+    let mut names = std::collections::BTreeSet::new();
+    for r in &snapshot.refs {
+        ensure!(valid_ref(&r.name), "invalid snapshot ref name {:?}", r.name);
+        ensure!(names.insert(&r.name), "duplicate snapshot ref {:?}", r.name);
+        ensure!(
+            valid_oid(&r.oid, oid_len),
+            "invalid snapshot OID for {}",
+            r.name
+        );
+        ensure!(
+            r.peeled.is_empty()
+                || (r.name.starts_with("refs/tags/") && valid_oid(&r.peeled, oid_len)),
+            "invalid snapshot peeled target for {}",
+            r.name
+        );
+    }
+    Ok(())
+}
+
+/// Sort refs and omit incidental creation time. Duplicate/conflicting refs are errors.
+pub fn canonicalize(snapshot: &RefSnapshot) -> Result<RefSnapshot> {
+    validate(snapshot)?;
+    let mut canonical = snapshot.clone();
+    canonical.refs.sort_by(|a, b| a.name.cmp(&b.name));
+    canonical.created_at = None;
+    Ok(canonical)
+}
+
+pub fn encode(snapshot: &RefSnapshot) -> Result<Vec<u8>> {
+    Ok(canonicalize(snapshot)?.encode_to_vec())
+}
+
+pub fn key(bytes: &[u8]) -> String {
+    format!("checkpoints/refs/{}.pb", hex::encode(Sha256::digest(bytes)))
+}
+
+/// Verify exact canonical encoding as well as the content-addressed key.
+pub fn decode_verified(expected_key: &str, bytes: &[u8]) -> Result<RefSnapshot> {
+    ensure!(key(bytes) == expected_key, "snapshot content key mismatch");
+    let snapshot = RefSnapshot::decode(bytes)?;
+    ensure!(
+        encode(&snapshot)? == bytes,
+        "snapshot encoding is not canonical"
+    );
+    Ok(snapshot)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::v1::Ref;
+    fn fixture(format: &str) -> RefSnapshot {
+        let len = if format == "sha1" { 40 } else { 64 };
+        RefSnapshot {
+            seq: 7,
+            object_format: format.into(),
+            head_target: "refs/heads/main".into(),
+            created_at: Some(crate::time::now()),
+            refs: vec![
+                Ref {
+                    name: "refs/tags/v1".into(),
+                    oid: "b".repeat(len),
+                    peeled: "a".repeat(len),
+                },
+                Ref {
+                    name: "refs/heads/main".into(),
+                    oid: "a".repeat(len),
+                    peeled: String::new(),
+                },
+            ],
+        }
+    }
+    #[test]
+    fn sha1_and_sha256_canonicalize_independently_of_time_and_order() {
+        for format in ["sha1", "sha256"] {
+            let mut s = fixture(format);
+            let bytes = encode(&s).unwrap();
+            s.refs.reverse();
+            s.created_at = None;
+            assert_eq!(bytes, encode(&s).unwrap());
+            assert_eq!(
+                decode_verified(&key(&bytes), &bytes).unwrap(),
+                canonicalize(&s).unwrap()
+            );
+            let mut conflict = s.clone();
+            conflict.refs[0].oid = "c".repeat(conflict.refs[0].oid.len());
+            assert_ne!(key(&bytes), key(&encode(&conflict).unwrap()));
+            assert!(decode_verified(&key(&bytes), &encode(&conflict).unwrap()).is_err());
+        }
+    }
+    #[test]
+    fn malformed_duplicate_and_noncanonical_snapshots_fail() {
+        let mut s = fixture("sha1");
+        s.refs.push(s.refs[0].clone());
+        assert!(encode(&s).is_err());
+        let mut s = fixture("sha1");
+        s.refs[0].oid = "0".repeat(40);
+        assert!(encode(&s).is_err());
+        let mut s = fixture("sha1");
+        s.refs[0].name = "refs/../x".into();
+        assert!(encode(&s).is_err());
+        let mut s = fixture("sha1");
+        s.head_target = "main".into();
+        assert!(encode(&s).is_err());
+        let s = fixture("sha1");
+        let noncanonical = s.encode_to_vec();
+        assert!(decode_verified(&key(&noncanonical), &noncanonical).is_err());
+        assert!(decode_verified("checkpoints/refs/not-a-digest.pb", &encode(&s).unwrap()).is_err());
+    }
+}
diff --git a/crates/walgit-server/Cargo.toml b/crates/walgit-server/Cargo.toml
index ea9adc6..9ad6341 100644
--- a/crates/walgit-server/Cargo.toml
+++ b/crates/walgit-server/Cargo.toml
@@ -12,7 +12,6 @@ walgit-config.workspace = true
 walgit-git.workspace = true
 walgit-wal.workspace = true
 async-trait.workspace = true
-walgit-bundle.workspace = true
 anyhow.workspace = true
 thiserror.workspace = true
 bytes.workspace = true
diff --git a/crates/walgit-server/src/bundles.rs b/crates/walgit-server/src/bundles.rs
deleted file mode 100644
index d9fc0f1..0000000
--- a/crates/walgit-server/src/bundles.rs
+++ /dev/null
@@ -1,276 +0,0 @@
-//! Bundle serving: `GET /{repo}/bundles/list` (git bundle-list text, no-cache)
-//! and `GET|HEAD /{repo}/bundles/{strategy}/{name}` (streamed bundle with
-//! strong `ETag` = store version, immutable caching, Range/If-Range,
-//! If-None-Match, HEAD — `static_object`).
-
-use axum::http::{HeaderMap, Method, StatusCode};
-use axum::response::{IntoResponse, Response};
-
-use crate::AppState;
-use crate::error::ApiError;
-use crate::repo::RepoRoute;
-use crate::smart::open_repo;
-use crate::static_object;
-
-/// `GET /{repo}/bundles/list[?filter=blob:none]` — the clone list: the unfiltered chain by
-/// default (what the protocol advertises); `?filter=blob:none` is the blobless
-/// family for `git clone --filter=blob:none --bundle-uri=<this URL>` (git does
-/// not match `bundle.<id>.filter` itself, so the two never share a list).
-/// `GET /{repo}/bundles/catchup[?filter=blob:none]` — the same list without the fulls: what the
-/// recipes record in `fetch.bundleURI`, so a fetch only ever walks incremental links (a full newer
-/// than the client's token would otherwise be downloaded whole).
-pub async fn list(
-    st: &AppState,
-    route: &RepoRoute,
-    headers: &HeaderMap,
-    query: &str,
-    fulls: bool,
-) -> Result<Response, ApiError> {
-    if !st.cfg.bundles.advertise {
-        return Err(ApiError::NotFound("bundles disabled".into()));
-    }
-    let principal = st.auth.require_read(headers).await.map_err(auth_err)?;
-    // This principal tried bundle-uri (see `smart::bundle_fallback_allowed`).
-    st.caches.bundle_attempts.insert(
-        format!("{}\0{}", route.id, principal.name),
-        std::time::Instant::now(),
-    );
-    let handle = open_repo(st, &route.id, false).await?;
-    let base = crate::smart::request_base_url(st, headers);
-    let filter: Option<String> = query
-        .split('&')
-        .find_map(|kv| {
-            kv.strip_prefix("filter=")
-                .map(|v| v.replace("%3A", ":").replace("%3a", ":"))
-        })
-        .filter(|v| !v.is_empty());
-    if let Some(f) = &filter
-        && f != "blob:none"
-    {
-        return Err(ApiError::BadRequest(format!(
-            "unsupported bundle filter {f:?} (blob:none)"
-        )));
-    }
-
-    // Rendered-list cache keyed by the list object's OWN version (one metadata
-    // probe, ~15 ms): a bundle published by any host changes `bundles/list.pb`,
-    // never the manifest, so this — not a TTL — is the invariant that a fresh
-    // clone never sees a stale list (2026-08-21: 20 minutes stale on the host
-    // that had just published). The building host additionally invalidates.
-    let repo_key = format!(
-        "{}?{}{}",
-        route.id,
-        filter.as_deref().unwrap_or(""),
-        if fulls { "" } else { "&catchup" }
-    );
-    let list_version =
-        walgit_store::ObjectStore::head(handle.store(), walgit_proto::keys::BUNDLE_LIST)
-            .await
-            .map_err(ApiError::from)?
-            .map(|m| m.version.to_string());
-    let Some(list_version) = list_version else {
-        return Err(ApiError::NotFound("no bundles".into()));
-    };
-    if let Some(cached) = st.caches.bundle_list.get(&repo_key, &list_version) {
-        return Ok(render_bundle_list_response(cached));
-    }
-
-    let text = st
-        .bundles
-        .render_list(&route.id, &base, filter.as_deref(), fulls)
-        .await
-        .map_err(bundle_err)?;
-    match text {
-        Some(t) => {
-            st.caches
-                .bundle_list
-                .insert(&repo_key, &list_version, t.clone());
-            Ok(render_bundle_list_response(t))
-        }
-        None => Err(ApiError::NotFound("no bundles".into())),
-    }
-}
-
-fn render_bundle_list_response(text: String) -> Response {
-    let mut resp = (StatusCode::OK, text).into_response();
-    let h = resp.headers_mut();
-    h.insert(
-        axum::http::header::CONTENT_TYPE,
-        "text/plain; charset=utf-8".parse().unwrap(),
-    );
-    h.insert(
-        axum::http::header::CACHE_CONTROL,
-        "no-cache".parse().unwrap(),
-    );
-    resp
-}
-
-/// `GET|HEAD /{repo}/bundles/{strategy}/{name}` — streamed from the store
-/// with the full immutable-object contract (strong `ETag`, 304, Range/If-Range,
-/// HEAD, Content-Length); see `static_object`.
-pub async fn object(
-    st: &AppState,
-    route: &RepoRoute,
-    method: &Method,
-    headers: &HeaderMap,
-    peer: Option<std::net::SocketAddr>,
-) -> Result<Response, ApiError> {
-    let _ = st.auth.require_read(headers).await.map_err(auth_err)?;
-    let handle = open_repo(st, &route.id, false).await?;
-    let store = handle.store().clone();
-
-    // subpath = "bundles/{strategy}/{name}"
-    let key = format!(
-        "bundles/{}",
-        route
-            .subpath
-            .strip_prefix("bundles/")
-            .unwrap_or(&route.subpath)
-    );
-    if key.split('/').any(|seg| seg.is_empty() || seg == "..") {
-        return Err(ApiError::NotFound("bad bundle path".into()));
-    }
-    static_object::serve(
-        &store,
-        &key,
-        method,
-        headers,
-        static_object::ServeOptions {
-            content_type: "application/x-git-bundle",
-            accel: st.cfg.server.accel_redirect,
-            peer,
-            ..Default::default()
-        },
-    )
-    .await
-}
-
-fn auth_err(e: crate::auth::AuthError) -> ApiError {
-    match e {
-        crate::auth::AuthError::Invalid | crate::auth::AuthError::Unauthorized => {
-            ApiError::Unauthorized
-        }
-        crate::auth::AuthError::Forbidden => ApiError::Forbidden,
-        crate::auth::AuthError::Unavailable => {
-            ApiError::ServiceUnavailable("auth provider unavailable".into())
-        }
-    }
-}
-fn bundle_err(e: walgit_bundle::BundleError) -> ApiError {
-    ApiError::Internal(format!("bundle: {e}"))
-}
-
-/// Full bundle = header ∘ the single tier-2 base pack, refs from the checkpoint
-/// at the base's seq (written now when the base is at head and none exists).
-/// Full bundle = header (refs at the base's seq) ∘ tier-2 base pack via GCS
-/// compose — zero bytes through this host, no index-pack, no disk. The weekly
-/// for any repository that has a tier-2 base (a large repository); `slot` is the calendar
-/// slot the bundle stands for (its `creationToken`; 0 = "now").
-pub async fn compose_full_from_base(
-    registry: &walgit_wal::Registry,
-    id: &walgit_git::RepoId,
-    strategy: &str,
-    cfg: &walgit_config::Config,
-    slot: u64,
-) -> anyhow::Result<walgit_proto::v1::BundleEntry> {
-    use tracing::info;
-    use walgit_proto::prost::Message;
-    use walgit_store::ObjectStoreExt;
-    let handle = registry.open(id).await?;
-    drop(handle.sync_refs().await?);
-    let manifest = handle.manifest();
-    // The base is the tier-2 pack that is not a derived history pack (D18:
-    // `compact --base` publishes both at tier 2; the weekly composes the base).
-    let bases = walgit_wal::base_packs(&manifest);
-    anyhow::ensure!(
-        bases.len() == 1,
-        "compose needs exactly one tier-2 base pack (found {}; history packs excluded): an imported pack set — the base rebuild unit (`compact --base`) collapses it first",
-        bases.len()
-    );
-    let base = bases[0].clone();
-    let seq = base.seq;
-    let store = handle.store();
-    // Refs at the base's seq: the checkpoint there when one exists (the rebuild checkpoints right
-    // after publishing), else replayed from the WAL — a checkpoint at or before the base's seq plus
-    // the ref transactions through it. Pushes that landed since the rebuild no longer matter (the
-    // rig's weekly compose failed every pass for as long as the churn kept refs moving, 2026-08-22);
-    // only a log folded away below the base's seq with no checkpoint before it is unrecoverable.
-    let refs_key = walgit_proto::keys::checkpoint_refs_key(seq);
-    let snap = if let Some((_, bytes)) = store.get_bytes(&refs_key).await? {
-        walgit_proto::v1::RefSnapshot::decode(bytes.as_ref())?
-    } else {
-        info!(
-            base_seq = seq,
-            head = manifest.head_seq,
-            "no checkpoint at the base's seq: replaying the refs at that seq from the WAL for the compose"
-        );
-        handle.refs_at_seq(seq).await.map_err(|e| {
-            anyhow::anyhow!("refs at the base's seq {seq} (head {}): {e} — run `walgit compact --base` again so a checkpoint exists at the base", manifest.head_seq)
-        })?
-    };
-    let list = walgit_bundle::ops::read_list(store)
-        .await?
-        .unwrap_or_default();
-    let prev_token = walgit_bundle::ops::max_creation_token(&list);
-    let now = std::time::SystemTime::now();
-    let format = handle.local().object_format();
-    // A filtered (blobless) full strategy composes the D18 **history pack** of
-    // the base (commits + trees = exactly `--filter=blob:none` of the refs at
-    // the base's seq) under a `@filter=blob:none` header; the unfiltered one
-    // composes the base itself.
-    let filter = cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == strategy)
-        .and_then(|s| s.filter.clone());
-    let pack = match &filter {
-        Some(_) => manifest
-            .packs
-            .iter()
-            .filter(|p| p.kind == walgit_proto::v1::PackKind::History as i32 && p.derived_from == base.checksum)
-            .max_by_key(|p| p.seq)
-            .cloned()
-            .ok_or_else(|| anyhow::anyhow!("strategy {strategy} is filtered but base {} has no history pack (D18) to compose; rebuild the base with git.history_pack on", &base.checksum[..12]))?,
-        None => base.clone(),
-    };
-    let pack_path = handle
-        .local()
-        .pack_path(&walgit_git::gix_hash::ObjectId::from_hex(
-            pack.checksum.as_bytes(),
-        )?);
-    let entry = walgit_bundle::ops::compose_full(
-        store,
-        &pack.checksum,
-        pack.pack_size,
-        pack_path.is_file().then_some(pack_path.as_path()),
-        &snap,
-        format,
-        strategy,
-        seq,
-        prev_token,
-        now,
-        slot,
-        filter.as_deref(),
-    )
-    .await?;
-    let new_entry = entry.clone();
-    let old_list = list;
-    let cas = walgit_bundle::ops::cas_update_list(store, cfg.wal.cas_max_retries, |current| {
-        let mut l = current.cloned().unwrap_or_default();
-        l.mode = "all".into();
-        l.heuristic = "creationToken".into();
-        l.bundles.push(new_entry.clone());
-        walgit_bundle::slots::retain(&cfg.bundles, &mut l);
-        l.updated_at = Some(walgit_proto::time::now());
-        Ok(Some(l))
-    })
-    .await?;
-    if let Some((_, new_list)) = &cas {
-        let pruned = walgit_bundle::ops::pruned_diff(&old_list, new_list);
-        if !pruned.is_empty() {
-            walgit_bundle::ops::delete_pruned(store, &pruned).await;
-        }
-    }
-    Ok(entry)
-}
diff --git a/crates/walgit-server/src/cache.rs b/crates/walgit-server/src/cache.rs
index 06c08bf..3634648 100644
--- a/crates/walgit-server/src/cache.rs
+++ b/crates/walgit-server/src/cache.rs
@@ -132,84 +132,6 @@ impl RefAdvertCache {
     }
 }
 
-// ---------------------------------------------------------------------------
-// Bundle list render cache
-// ---------------------------------------------------------------------------
-
-/// Cache key for the rendered bundle list: the repo (freshness = TTL + the
-/// building host's own invalidation, see `BundleListCache`).
-#[derive(Clone, PartialEq, Eq, Hash)]
-struct BundleListKey {
-    repo: String,
-    /// Version (generation) of `bundles/list.pb` the text was rendered from.
-    list_version: String,
-}
-
-/// Cache for rendered bundle list text, keyed by (repo, **version of
-/// `bundles/list.pb`**) — the object a bundle publish actually changes (the
-/// manifest does not; keyed by manifest version it served a 20-minute-stale
-/// list on the very host that had just published, 2026-08-21). One metadata
-/// probe per request decides freshness on every host; the building host also
-/// invalidates. The TTL only bounds memory for repos nobody asks about.
-#[derive(Clone)]
-pub struct BundleListCache {
-    inner: Cache<BundleListKey, String>,
-}
-
-/// Idle lifetime of a rendered list (freshness comes from the version key).
-pub const BUNDLE_LIST_TTL: std::time::Duration = std::time::Duration::from_mins(10);
-
-impl BundleListCache {
-    pub fn new(max_entries: usize) -> Self {
-        Self::with_ttl(max_entries, BUNDLE_LIST_TTL)
-    }
-
-    pub fn with_ttl(max_entries: usize, ttl: std::time::Duration) -> Self {
-        Self {
-            inner: Cache::builder()
-                .max_capacity(max_entries as u64)
-                .time_to_live(ttl)
-                .support_invalidation_closures()
-                .build(),
-        }
-    }
-
-    pub fn get(&self, repo: &str, list_version: &str) -> Option<String> {
-        let key = BundleListKey {
-            repo: repo.to_string(),
-            list_version: list_version.to_string(),
-        };
-        if let Some(val) = self.inner.get(&key) {
-            metrics::counter!("walgit_cache_bundle_list_hit").increment(1);
-            Some(val)
-        } else {
-            metrics::counter!("walgit_cache_bundle_list_miss").increment(1);
-            None
-        }
-    }
-
-    pub fn insert(&self, repo: &str, list_version: &str, text: String) {
-        self.inner.insert(
-            BundleListKey {
-                repo: repo.to_string(),
-                list_version: list_version.to_string(),
-            },
-            text,
-        );
-    }
-
-    /// This host built/published a bundle for `repo`: drop every render of it
-    /// (belt and braces — the version key already misses on the new list).
-    pub fn invalidate(&self, repo: &str) {
-        let repo = repo.to_string();
-        let _ = self.inner.invalidate_entries_if(move |k, _| k.repo == repo);
-    }
-}
-
-// ---------------------------------------------------------------------------
-// ServerCaches — aggregate held by AppState
-// ---------------------------------------------------------------------------
-
 // ---------------------------------------------------------------------------
 // Ref index (web API): exact-name lookups + name-sorted namespaces
 // ---------------------------------------------------------------------------
@@ -331,23 +253,15 @@ impl RefIndexCache {
 #[derive(Clone)]
 pub struct ServerCaches {
     pub ref_advert: RefAdvertCache,
-    pub bundle_list: BundleListCache,
     pub ref_index: RefIndexCache,
     /// Rendered sha-addressed web API JSON (immutable): key = repo\0kind\0sha\0path.
     pub api_immutable: Cache<String, bytes::Bytes>,
-    /// `bundles.require` fallback (D17 amendment): when a principal fetched a
-    /// repo's `bundles/list` (`key = repo\0principal` → when), it *tried*
-    /// bundle-uri; a zero-have full fetch from it within the hour is a bundle
-    /// download that failed, and gets ONE upload-pack clone per
-    /// `FALLBACK_EVERY` (the second entry, `repo\0principal\0fallback`).
-    pub bundle_attempts: Cache<String, std::time::Instant>,
 }
 
 impl ServerCaches {
     pub fn new(cfg: &walgit_config::Config) -> Self {
         Self {
             ref_advert: RefAdvertCache::new(cfg.cache.ref_advert_entries),
-            bundle_list: BundleListCache::new(cfg.cache.bundle_list_entries),
             ref_index: RefIndexCache::new(cfg.cache.ref_advert_entries.max(64)),
             api_immutable: Cache::builder()
                 .max_capacity(64 * 1024 * 1024)
@@ -355,10 +269,6 @@ impl ServerCaches {
                     (k.len() + v.len()).min(u32::MAX as usize) as u32
                 })
                 .build(),
-            bundle_attempts: Cache::builder()
-                .max_capacity(100_000)
-                .time_to_live(std::time::Duration::from_hours(6))
-                .build(),
         }
     }
 }
@@ -476,38 +386,6 @@ mod tests {
         );
     }
 
-    /// A bundle publish changes list.pb, not the manifest: the rendered list
-    /// must expire on its own (prod served a 20-minute-stale list, 2026-08-21).
-    #[tokio::test]
-    async fn bundle_list_cache_expires_without_a_manifest_change() {
-        let c = BundleListCache::with_ttl(8, std::time::Duration::from_millis(60));
-        c.insert("o/r", "g1", "[bundle] one".into());
-        assert_eq!(c.get("o/r", "g1").as_deref(), Some("[bundle] one"));
-        tokio::time::sleep(std::time::Duration::from_millis(120)).await;
-        assert!(
-            c.get("o/r", "g1").is_none(),
-            "idle entry gone after the TTL"
-        );
-    }
-
-    #[test]
-    fn bundle_list_cache_hit_miss() {
-        let cache = BundleListCache::new(16);
-        assert!(cache.get("acme/monorepo", "g1").is_none());
-        cache.insert("acme/monorepo", "g1", "bundle list text".into());
-        assert_eq!(
-            cache.get("acme/monorepo", "g1"),
-            Some("bundle list text".into())
-        );
-        // A new list.pb generation → miss (the invariant); another repo → miss.
-        assert!(cache.get("acme/monorepo", "g2").is_none());
-        assert!(cache.get("acme/other", "g1").is_none());
-        // This host's build → every render of the repo dropped.
-        cache.invalidate("acme/monorepo");
-        std::thread::sleep(std::time::Duration::from_millis(50)); // moka applies closure invalidation lazily
-        assert!(cache.get("acme/monorepo", "g1").is_none());
-    }
-
     #[test]
     fn cache_eviction_by_size() {
         let cache = RefAdvertCache::new(2);
@@ -620,7 +498,7 @@ mod tests {
         // Measure: cache miss (first render).
         let start = Instant::now();
         let mut buf = Vec::with_capacity(4 * 1024 * 1024);
-        repo.advertise_refs_v0(Service::UploadPack, &mut buf)
+        repo.advertise_refs_v0(Service::UploadPack, &mut buf, None)
             .unwrap();
         let render_ms = start.elapsed().as_millis();
         let advert_bytes = buf.len();
diff --git a/crates/walgit-server/src/follow.rs b/crates/walgit-server/src/follow.rs
index 261399a..562826b 100644
--- a/crates/walgit-server/src/follow.rs
+++ b/crates/walgit-server/src/follow.rs
@@ -8,7 +8,7 @@
 //! stream the pack through `ingest_pack`, connectivity + fast-forward checks, one
 //! `publish_push` — the same PUSH entry receive-pack publishes, `principal =
 //! upstream`. Every other instance picks it up the way it picks up a push (the next
-//! conditional GET of `manifest.pb`); the maintainer's checkpoints/bundles fold it
+//! conditional GET of `manifest.pb`); the maintainer's checkpoints fold it
 //! like a push. A rewound upstream is refused (not a fast-forward) and logged every
 //! round until a human decides; policy is not evaluated (follow is configuration,
 //! not a principal — remove the ref from `follow` to stop it).
diff --git a/crates/walgit-server/src/forward.rs b/crates/walgit-server/src/forward.rs
index 1b30ce6..88de31a 100644
--- a/crates/walgit-server/src/forward.rs
+++ b/crates/walgit-server/src/forward.rs
@@ -2,9 +2,9 @@
 //! writer that batches the manifest CAS for many small repositories.
 //!
 //! The request body and broker response are deliberately kept as streams.  A
-//! front falls back to its local receive-pack path only when no broker response
-//! was obtained, or when the broker explicitly reports a gateway-unavailable
-//! status before a response body is consumed.
+//! front falls back only before delivery (preflight or connection failure).
+//! A gateway response or loss after connection can follow a committed push;
+//! neither permits local replay. Redirects and transport retries are disabled.
 //!
 //! The hop authenticates with `wal.push_broker_token` (or `WALGIT_BROKER_TOKEN`):
 //! a static token the broker lists under `server.auth.tokens` with `write = true`
@@ -15,7 +15,7 @@ use std::time::Instant;
 
 use axum::{
     body::Body,
-    http::{HeaderMap, HeaderValue, StatusCode, header},
+    http::{HeaderMap, HeaderValue, header},
     response::Response,
 };
 use futures::StreamExt;
@@ -26,11 +26,10 @@ use crate::{auth::Principal, repo::RepoRoute};
 pub enum ForwardOutcome {
     /// A broker response was obtained and can be returned to the Git client.
     Response(Response),
-    /// The broker was not reached or returned a gateway-unavailable response.
-    /// The caller still owns the body only when the broker was not reached before
-    /// any bytes were sent; smart.rs therefore buffers only the local fallback
-    /// path and never retries after an acknowledged broker request.
+    /// No request was delivered; a buffered body may be handled locally.
     Fallback,
+    /// Delivery may have occurred. Never replay the body locally.
+    Ambiguous,
 }
 
 /// Stream one receive-pack request to the broker and stream its response back.
@@ -51,7 +50,13 @@ pub async fn receive_pack(
         route.id.owner(),
         route.id.name()
     );
-    let client = reqwest::Client::new();
+    let Ok(client) = reqwest::Client::builder()
+        .redirect(reqwest::redirect::Policy::none())
+        .retry(reqwest::retry::never())
+        .build()
+    else {
+        return ForwardOutcome::Fallback;
+    };
     let stream = body
         .into_data_stream()
         .map(|chunk| chunk.map_err(|e| std::io::Error::other(e.to_string())));
@@ -95,22 +100,15 @@ pub async fn receive_pack(
     let response = match request.send().await {
         Ok(response) => response,
         Err(error) => {
-            tracing::warn!(%error, elapsed_ms = u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX), "push broker unavailable; falling back");
-            return ForwardOutcome::Fallback;
+            let before_delivery = error.is_connect();
+            tracing::warn!(%error, before_delivery, elapsed_ms = u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX), "push broker request failed");
+            return if before_delivery {
+                ForwardOutcome::Fallback
+            } else {
+                ForwardOutcome::Ambiguous
+            };
         }
     };
-    if matches!(
-        response.status(),
-        StatusCode::BAD_GATEWAY | StatusCode::SERVICE_UNAVAILABLE | StatusCode::GATEWAY_TIMEOUT
-    ) {
-        tracing::warn!(
-            status = response.status().as_u16(),
-            elapsed_ms = u64::try_from(started.elapsed().as_millis()).unwrap_or(u64::MAX),
-            "push broker gateway failure; falling back"
-        );
-        return ForwardOutcome::Fallback;
-    }
-
     let status = response.status();
     let response_headers = response.headers().clone();
     let stream = response
@@ -122,6 +120,7 @@ pub async fn receive_pack(
         header::CONTENT_ENCODING,
         header::CACHE_CONTROL,
         header::ETAG,
+        header::RETRY_AFTER,
     ] {
         if let Some(value) = response_headers.get(&name) {
             builder = builder.header(name, value);
diff --git a/crates/walgit-server/src/lfs.rs b/crates/walgit-server/src/lfs.rs
index 4a12e18..da8bc30 100644
--- a/crates/walgit-server/src/lfs.rs
+++ b/crates/walgit-server/src/lfs.rs
@@ -162,7 +162,7 @@ pub async fn batch(
             });
         } else if exists {
             let href = match cfg.lfs.serve_via {
-                walgit_config::BundleServe::SignedUrl => store
+                walgit_config::LfsServe::SignedUrl => store
                     .signed_get_url(&key, st.cfg.lfs.signed_url_ttl)
                     .await
                     .ok()
diff --git a/crates/walgit-server/src/lib.rs b/crates/walgit-server/src/lib.rs
index b0bb850..5f6c615 100644
--- a/crates/walgit-server/src/lib.rs
+++ b/crates/walgit-server/src/lib.rs
@@ -1,4 +1,4 @@
-//! Git smart HTTP server (protocol v0/v2), LFS, bundle serving, admin, health, metrics.
+//! Git smart HTTP server (protocol v0/v2), LFS, admin, health, metrics.
 //! See AGENTS.md Phase 3.
 #![allow(
     clippy::case_sensitive_file_extension_comparisons,
@@ -33,7 +33,6 @@
 pub mod admin;
 pub mod auth;
 pub mod bridge;
-pub mod bundles;
 pub mod cache;
 pub mod error;
 pub mod events;
@@ -47,10 +46,11 @@ pub mod maintain;
 pub mod metrics;
 pub mod middleware;
 pub mod ops;
+pub mod pack_lifecycle;
+pub mod packfile_uri;
 pub mod pktline;
 pub mod policy;
 pub mod prewarm;
-pub mod rebuild;
 pub mod repo;
 pub mod settings;
 pub mod setup;
@@ -84,7 +84,6 @@ pub struct AppState {
     pub cfg: Arc<walgit_config::Config>,
     pub store: DynStore,
     pub registry: Arc<walgit_wal::Registry>,
-    pub bundles: Arc<walgit_bundle::Bundler>,
     pub auth: Arc<auth::Authenticator>,
     pub semaphores: middleware::RepoSemaphores,
     /// HTTP requests in flight (counted until the response body is done); on the watchdog line.
@@ -113,9 +112,6 @@ impl AppState {
     ) -> anyhow::Result<Arc<Self>> {
         let registry = walgit_wal::Registry::new(store.clone(), cfg.clone());
         let bridge = bridge::Bridge::new(&cfg, registry.clone());
-        let bundle_source: Arc<dyn walgit_bundle::BundleSource> =
-            Arc::new(RegistryBundleSource(registry.clone()));
-        let bundles = walgit_bundle::Bundler::new_with_source(bundle_source, cfg.clone());
         let metrics_handle = metrics::install()?;
         let tls = tls::load(&cfg)?;
         if let Some(t) = &tls {
@@ -125,7 +121,6 @@ impl AppState {
             cfg: cfg.clone(),
             store,
             registry,
-            bundles,
             auth: auth::Authenticator::new(&cfg),
             semaphores: middleware::RepoSemaphores::new(cfg.server.max_concurrent_per_repo),
             inflight: Arc::new(middleware::Inflight::default()),
@@ -143,7 +138,7 @@ impl AppState {
 /// Build a full axum router.
 pub fn router(state: Arc<AppState>) -> Router {
     // Dynamic web responses (JSON API, SPA index/overview) are compressed on
-    // the fly; git smart-HTTP, bundles and LFS bytes never are (packs are
+    // the fly; git smart-HTTP and LFS bytes never are (packs are
     // already compressed, and `Content-Length`/`Range` must stay exact).
     // Embedded `/_ui/assets` arrive precompressed from the build and carry
     // their own `Content-Encoding`, which this layer leaves untouched; SSE is
@@ -354,7 +349,7 @@ pub(crate) fn request_peer(req: &Request<Body>) -> Option<SocketAddr> {
 }
 
 /// Route a parsed repo request (`/{owner}/{repo}[.git]/<sub>` or the same sub
-/// under `/{owner}/{repo}/api[-browser]`) to git smart-HTTP, LFS, bundles,
+/// under `/{owner}/{repo}/api[-browser]`) to git smart-HTTP, LFS,
 /// repo admin and policy handlers.
 pub(crate) async fn dispatch_route(
     st: &Arc<AppState>,
@@ -369,6 +364,9 @@ pub(crate) async fn dispatch_route(
     let sub = route.subpath.as_str();
     let result: Result<Response, ApiError> = async {
         match (&method, sub) {
+            (&Method::GET | &Method::HEAD, s) if s.starts_with("packfiles/") => {
+                packfile_uri::get(st, route, &method, &headers, peer).await
+            }
             (&Method::GET, "info/refs") => {
                 let _permit = acquire(st, route).await;
                 smart::info_refs(st, route, &headers, &query).await
@@ -397,17 +395,6 @@ pub(crate) async fn dispatch_route(
                 let bytes = collect_body(body.take().unwrap()).await?;
                 lfs::verify(st, route, &headers, bytes).await
             }
-            (&Method::GET, "bundles/list") => {
-                bundles::list(st, route, &headers, &query, true).await
-            }
-            (&Method::GET, "bundles/catchup") => {
-                bundles::list(st, route, &headers, &query, false).await
-            }
-            (&Method::GET | &Method::HEAD, s)
-                if s.starts_with("bundles/") && s != "bundles/list" && s != "bundles/catchup" =>
-            {
-                bundles::object(st, route, &method, &headers, peer).await
-            }
             (&Method::PUT, "") => admin::create(st, route, &headers, &query).await,
             (&Method::DELETE, "") => admin::delete(st, route, &headers).await,
             // Admin routes reach here only through `/{o}/{r}/api[-browser]/…` (web::v1).
@@ -662,118 +649,6 @@ pub fn listen_url(cfg: &walgit_config::Config) -> String {
 /// is dropped on abort; a blocking git child is left to die with the container).
 const UNIT_STOP_MAX: std::time::Duration = std::time::Duration::from_secs(30);
 
-/// Server-side adapter implementing `walgit_bundle::BundleSource` over a
-/// `walgit_wal::Registry`. Defined here (server owns the type) so the orphan
-/// rule is satisfied; lets us use `Bundler::new_with_source` without waiting for
-/// a Registry impl in the bundle crate.
-struct RegistryBundleSource(Arc<walgit_wal::Registry>);
-
-#[async_trait::async_trait]
-impl walgit_bundle::BundleSource for RegistryBundleSource {
-    async fn open_repo(
-        &self,
-        id: &walgit_git::RepoId,
-    ) -> Result<walgit_bundle::BundleRepoHandle, walgit_bundle::BundleError> {
-        let h = self.0.open(id).await.map_err(|e| match e {
-            walgit_wal::WalError::NotFound => {
-                walgit_bundle::BundleError::RepoNotFound(id.to_string())
-            }
-            other => walgit_bundle::BundleError::Other(other.to_string()),
-        })?;
-        Ok(walgit_bundle::BundleRepoHandle {
-            local: h.local().clone(),
-            store: h.store().clone(),
-            head_seq: h.manifest().head_seq,
-            engine: walgit_bundle::BundleEngine::Git,
-            cfg: Some(h.effective_config()),
-        })
-    }
-
-    async fn prepare_objects(
-        &self,
-        id: &walgit_git::RepoId,
-    ) -> Result<(), walgit_bundle::BundleError> {
-        // `git bundle create` streams from the local copy: bring the packs
-        // here first (Serve level). Registry::open alone is refs-level — the
-        // maintainer built from it and git said "bad object refs/heads/main".
-        // Too-large repos fail with the "larger than this instance" message
-        // that run_all_due treats as "skipped, the VM job builds those".
-        // Never from open_repo: list/advert callers hold a read guard and a
-        // sync here would deadlock on the repo's write lock.
-        let h = self
-            .0
-            .open(id)
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?;
-        drop(
-            h.sync()
-                .await
-                .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?,
-        );
-        Ok(())
-    }
-
-    /// gix (+ remote faulter) when the base is remote-served or linked from
-    /// the store mount (stock git would read every boundary tree through the
-    /// mount or fail), git on a complete local copy.
-    async fn engine(&self, id: &walgit_git::RepoId) -> walgit_bundle::BundleEngine {
-        let Ok(h) = self.0.open(id).await else {
-            return walgit_bundle::BundleEngine::Git;
-        };
-        if !h.remote_served().is_empty() {
-            match h.remote_reader().await {
-                Ok(reader) => {
-                    return walgit_bundle::BundleEngine::Gix {
-                        faulter: Some(Arc::new(walgit_wal::remote::Faulter::new(
-                            reader,
-                            h.local().clone(),
-                        ))),
-                    };
-                }
-                Err(e) => {
-                    tracing::warn!(repo = %id, error = %e, "remote reader unavailable for bundle build; using git");
-                }
-            }
-        }
-        let linked = h.local().packs().is_ok_and(|ps| {
-            ps.iter()
-                .any(|p| h.local().pack_path(&p.checksum).is_symlink())
-        });
-        if linked {
-            return walgit_bundle::BundleEngine::Gix { faulter: None };
-        }
-        walgit_bundle::BundleEngine::Git
-    }
-
-    async fn refs_as_of(
-        &self,
-        id: &walgit_git::RepoId,
-        at: std::time::SystemTime,
-    ) -> Result<Option<(walgit_git::RefSnapshotData, u64)>, walgit_bundle::BundleError> {
-        let h = self
-            .0
-            .open(id)
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?;
-        let (snap, seq) = h
-            .refs_as_of(at)
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?;
-        if seq == 0 {
-            return Ok(None); // nothing at that time (or predates replayable history)
-        }
-        Ok(Some((snap.into(), seq)))
-    }
-
-    async fn list_repos(&self) -> Result<Vec<walgit_git::RepoId>, walgit_bundle::BundleError> {
-        Ok(self
-            .0
-            .list()
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?)
-    }
-}
-
 #[cfg(test)]
 mod listen_tests {
     #[tokio::test]
diff --git a/crates/walgit-server/src/maintain.rs b/crates/walgit-server/src/maintain.rs
index 7d73aba..2684657 100644
--- a/crates/walgit-server/src/maintain.rs
+++ b/crates/walgit-server/src/maintain.rs
@@ -1,22 +1,4 @@
-//! The `maintain` role: a **permanent, self-healing priority loop**. Every
-//! `maintenance.interval`, for each *assigned* repository (`[maintenance]
-//! repos` minus `exclude` — placement by rule), it picks the most important
-//! unit of work and does exactly ONE bounded unit as a task (discoverable at
-//! `…/tasks`, visible on the WAL page):
-//!
-//! 1. checkpoint-if-due (refs-level; works for any repo on any host),
-//! 2. the missing **weekly** slot (full bundle; compose for repos whose base is
-//!    not a local copy here — or `wrong-host`),
-//! 3. missing **daily** slots, oldest first (backfill),
-//! 4. missing **hourly** slots, oldest first,
-//! 5. geometric compaction when triggered.
-//!
-//! Slot content = the WAL state as of the slot (highest seq with
-//! `created_at <= slot`); a slot before the repository's first WAL state is
-//! `unavailable` (not an error); a unit this host cannot hold is `wrong-host`
-//! and left to the host that can (`[maintenance] max_pack_bytes`, `disk`).
-//! Each pass writes a heartbeat (`maintain/<host>.pb`) so the plan shows who
-//! maintains a repository and whether that host is alive.
+//! Bounded maintenance from committed state: checkpoints, repair, compaction and audits.
 
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -24,7 +6,6 @@ use std::time::{Instant, SystemTime};
 
 use prost::Message;
 use tracing::{Instrument, info, warn};
-use walgit_bundle::slots::{PlanContext, SlotStatus};
 use walgit_git::RepoId;
 use walgit_store::{PutBody, PutMode, PutOptions};
 
@@ -48,8 +29,7 @@ pub async fn run_loop(state: Arc<AppState>) {
         // `maintain.pass`: one close line per pass with the counts; every unit
         // (and its task.run) is a child, so a trace holds the whole pass.
         let span = tracing::info_span!("maintain.pass", host = %host, pass = passes, repos = tracing::field::Empty, units = tracing::field::Empty, skipped = tracing::field::Empty, outcome = tracing::field::Empty);
-        // Heartbeat DURING the pass too: a long unit (Sunday's 25-min base
-        // rebuild, a 1 h rev-index over a 32 GB pack) otherwise shows the host
+        // Heartbeat during long pack and reverse-index work; otherwise it shows the host
         // STALE and `upcoming` as "no live maintainer" while it is working.
         let ticker = {
             let (state, host, last_unit) = (state.clone(), host.clone(), last_unit.clone());
@@ -80,7 +60,6 @@ pub async fn run_loop(state: Arc<AppState>) {
                         repos = r.repos,
                         units = r.units,
                         checkpoints = r.checkpoints,
-                        bundles = r.bundles,
                         compactions = r.compactions,
                         "maintenance pass"
                     );
@@ -105,7 +84,6 @@ pub struct PassReport {
     pub repos: usize,
     pub units: usize,
     pub checkpoints: usize,
-    pub bundles: usize,
     pub compactions: usize,
     pub last_unit: Option<String>,
     /// Repos that had a unit this host could not run (wrong-host/too-small/blocked are not counted here; planning errors are).
@@ -117,16 +95,9 @@ pub struct PassReport {
 #[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
 pub enum Unit {
     Checkpoint(String),
-    /// `(strategy, slot)`
-    BundleSlot(String, u64),
     Compact,
     /// fsck found missing objects and `upstream.git` can supply them.
     Repair(u64),
-    /// A full (weekly) slot is missing and pushes landed since the tier-2 base:
-    /// rebuild the base first (`compact --base`: repack -adb + history pack +
-    /// bitmap + commit-graph, checkpoint) on this ssd host, then the slot
-    /// composes it. `(strategy, slot)` of the full slot waiting on it.
-    BaseRebuild(String, u64),
     /// An installed pack the manifest advertises without a `.rev` (written by
     /// git < 2.41, or imported without one): build it here, upload it as the
     /// side-file, CAS it into the manifest — every other host then downloads
@@ -154,91 +125,6 @@ pub fn host_name(state: &AppState) -> String {
         .unwrap_or_else(|| walgit_store::coord::instance_id().to_string())
 }
 
-/// The planner's view of this host for `id`.
-pub fn plan_context(state: &AppState, handle: &walgit_wal::RepoHandle) -> PlanContext {
-    let cap = state.cfg.maintenance.max_pack_bytes.as_u64();
-    let cap = if cap == 0 {
-        state.cfg.cache_budget_bytes()
-    } else {
-        cap
-    };
-    let full_bytes: u64 = handle
-        .manifest()
-        .packs
-        .iter()
-        .map(|p| p.pack_size + p.idx_size)
-        .sum();
-    let ssd = state.cfg.maintenance.disk == walgit_config::MaintainerDisk::Ssd;
-    // A full bundle is a compose of an existing base when one exists (any
-    // host), else `git bundle create` on a complete local copy: the set must
-    // fit this host's declared capacity (large-repository-sized sets only fit an ssd
-    // host; a small repo is fine on tmpfs).
-    let has_base = walgit_wal::base_pack(&handle.manifest()).is_some();
-    // cap == 0 ⇒ unlimited (disk mode, D25).
-    let can_full = has_base || ((cap == 0 || full_bytes <= cap) && (ssd || handle.packs_fit()));
-    let can_incremental = handle.serve_fits();
-    let first_state = handle.first_state_time();
-    PlanContext {
-        first_state,
-        can_full,
-        can_incremental,
-        wrong_host_reason: if !can_incremental {
-            Some("the serving copy does not fit this host's cache")
-        } else if !can_full {
-            Some("a full bundle needs the whole pack set on an ssd host")
-        } else {
-            None
-        },
-    }
-}
-
-/// Plan → span fields + `walgit_bundle_plan_slots{repo,strategy,state}` gauges.
-fn record_plan(
-    span: &tracing::Span,
-    id: &RepoId,
-    cfg: &walgit_config::BundlesConfig,
-    rows: &[walgit_bundle::slots::SlotPlan],
-) {
-    let state_of = |s: &SlotStatus| -> &'static str {
-        match s {
-            SlotStatus::Built { .. } => "built",
-            SlotStatus::Missing => "missing",
-            SlotStatus::Pending => "pending",
-            SlotStatus::Blocked(_) => "blocked",
-            SlotStatus::TooSmall { .. } => "too-small",
-            SlotStatus::Skipped { .. } => "skipped",
-            SlotStatus::Unavailable => "unavailable",
-            SlotStatus::WrongHost(_) => "wrong-host",
-        }
-    };
-    let count = |st: &str| rows.iter().filter(|r| state_of(&r.status) == st).count() as u64;
-    span.record("slots", rows.len() as u64);
-    span.record("built", count("built"));
-    span.record("missing", count("missing"));
-    span.record("too_small", count("too-small"));
-    span.record("wrong_host", count("wrong-host"));
-    span.record("unavailable", count("unavailable"));
-    for strat in &cfg.strategy {
-        for st in [
-            "built",
-            "missing",
-            "blocked",
-            "too-small",
-            "skipped",
-            "unavailable",
-            "wrong-host",
-        ] {
-            let n = rows
-                .iter()
-                .filter(|r| r.strategy == strat.name && state_of(&r.status) == st)
-                .count();
-            metrics::gauge!("walgit_bundle_plan_slots", "repo" => id.to_string(), "strategy" => strat.name.clone(), "state" => st).set(n as f64);
-        }
-    }
-}
-
-/// The next unit for `id` on this host (pure w.r.t. side effects except a
-/// refs sync and a bundle-list read).
 pub async fn next_unit(state: &Arc<AppState>, id: &RepoId) -> anyhow::Result<Unit> {
     if !state.cfg.placement.maintains(id.owner(), id.name()) {
         return Ok(Unit::NotAssigned);
@@ -247,7 +133,7 @@ pub async fn next_unit(state: &Arc<AppState>, id: &RepoId) -> anyhow::Result<Uni
     handle.sync_refs().await?;
     // D24: the repository's effective config (host ⊕ settings) decides what is
     // due; host-level facts (roles, assignment, capacity) stay the host's.
-    let cfg = handle.effective_config();
+    let cfg = handle.validated_effective_config()?;
     {
         // Checkpoint lag/age gauges: how far the fold is behind the head.
         let m = handle.manifest();
@@ -287,91 +173,11 @@ pub async fn next_unit(state: &Arc<AppState>, id: &RepoId) -> anyhow::Result<Uni
             return Ok(Unit::Repair(f.missing_total));
         }
     }
-    if cfg.bundles.enabled && state.cfg.has_role(walgit_config::Role::Bundle) {
-        let ctx = plan_context(state, &handle);
-        let span = tracing::info_span!("bundle.plan", repo = %id, slots = tracing::field::Empty, missing = tracing::field::Empty, too_small = tracing::field::Empty, wrong_host = tracing::field::Empty, unavailable = tracing::field::Empty, built = tracing::field::Empty);
-        // Settle closed slots first (refs-level, no unit): the plan below then
-        // shows them `skipped` and the first missing slot is real work.
-        // Retention is a pure function of (config, list): apply it every pass so a list that
-        // grew under an older rule — or an idle repository that publishes nothing — shrinks too.
-        match state.bundles.apply_retention(id).await {
-            Ok(n) if n > 0 => tracing::info!(repo = %id, pruned = n, "bundle retention applied"),
-            Ok(_) => {}
-            Err(e) => {
-                tracing::warn!(repo = %id, error = %e, "bundle retention failed; the next publish applies it");
-            }
-        }
-        match state
-            .bundles
-            .settle_closed_slots(id, SystemTime::now())
-            .await
-        {
-            Ok(n) if n > 0 => {
-                tracing::info!(repo = %id, settled = n, "closed bundle slots settled");
-            }
-            Ok(_) => {}
-            Err(e) => {
-                tracing::warn!(repo = %id, error = %e, "settling closed slots failed; units will measure them");
-            }
-        }
-        let rows = state
-            .bundles
-            .plan(id, SystemTime::now(), ctx)
-            .instrument(span.clone())
-            .await?;
-        record_plan(&span, id, &cfg.bundles, &rows);
-        // Strategies in config order = priority (weekly, daily, hourly); slots
-        // oldest first inside a strategy.
-        for strat in &cfg.bundles.strategy {
-            if let Some(r) = rows
-                .iter()
-                .filter(|r| r.strategy == strat.name && r.status == SlotStatus::Missing)
-                .min_by_key(|r| r.slot)
-            {
-                // The weekly slot is when the base is rebuilt (AGENTS §2.5): so the full bundle
-                // carries the week and the chain below it restarts small. On any host whose
-                // declared capacity holds the whole pack set (an SSD host for a large repository; a tmpfs host
-                // for the long tail), when: there is no bitmap'd base yet (a repo that only ever
-                // saw pushes and folds — Health used to ask a human to run `compact base=1`),
-                // several tier-2 packs exist (an imported set; the compose needs exactly one), or
-                // the base predates the slot's window (pushes landed since it).
-                // A base rebuild is compaction: `[compaction] enabled = false` (a large repository, 2026-08-22) stops it too.
-                if strat.kind == walgit_config::BundleKind::Full
-                    && cfg.compaction.enabled
-                    && state.cfg.has_role(walgit_config::Role::Compact)
-                    && handle.packs_fit()
-                {
-                    let m = handle.manifest();
-                    let live_bytes: u64 = m.packs.iter().map(|p| p.pack_size + p.idx_size).sum();
-                    let cap = state.cfg.maintenance.max_pack_bytes.as_u64();
-                    let ssd = state.cfg.maintenance.disk == walgit_config::MaintainerDisk::Ssd;
-                    let cap = if cap == 0 {
-                        state.cfg.cache_budget_bytes()
-                    } else {
-                        cap
-                    };
-                    let holds = ssd || cap == 0 || live_bytes <= cap;
-                    let bases = walgit_wal::base_packs(&m);
-                    let due = match walgit_wal::base_pack(&m).cloned() {
-                        None => !m.packs.is_empty(),
-                        Some(base) => {
-                            bases.len() > 1
-                                || !base.has_bitmap
-                                || base_predates_window(&handle, strat, r.slot, base.seq).await
-                        }
-                    };
-                    if holds && due {
-                        return Ok(Unit::BaseRebuild(strat.name.clone(), r.slot));
-                    }
-                }
-                return Ok(Unit::BundleSlot(strat.name.clone(), r.slot));
-            }
-        }
-    }
-    if cfg.compaction.enabled
+    if cfg.packs.enabled
         && state.cfg.has_role(walgit_config::Role::Compact)
         && handle.packs_fit()
-        && crate::ops::compaction_triggered(&handle, &cfg)
+        && crate::pack_lifecycle::plan(&handle.manifest(), &cfg, std::time::SystemTime::now())
+            .is_some()
     {
         return Ok(Unit::Compact);
     }
@@ -417,142 +223,6 @@ pub async fn next_unit(state: &Arc<AppState>, id: &RepoId) -> anyhow::Result<Uni
     Ok(Unit::Idle)
 }
 
-/// Stale bundle slots skipped through within one pass before the loop yields.
-const SKIP_THROUGH_MAX: u32 = 48;
-
-/// Whether the tier-2 base at `base_seq` was built before the window the full
-/// slot `slot` covers: the window starts at the previous slot (or the
-/// repository's first state); the WAL seq as of that instant is the bar.
-/// `base_seq ≤ bar` ⇒ rebuild. Pushes that land *during* a rebuild do not
-/// re-trigger one (the new base's seq is above the bar); next week's slot does.
-async fn base_predates_window(
-    handle: &walgit_wal::RepoHandle,
-    strat: &walgit_config::BundleStrategy,
-    slot: u64,
-    base_seq: u64,
-) -> bool {
-    let prev = walgit_bundle::slots::last_slot_at_or_before(
-        strat,
-        walgit_bundle::slots::from_epoch(slot.saturating_sub(1)),
-    )
-    .ok()
-    .flatten();
-    let mut window_start = prev.map(walgit_bundle::slots::from_epoch);
-    if let Some(first) = handle.first_state_time() {
-        window_start = Some(window_start.map_or(first, |w| w.max(first)));
-    }
-    let Some(ws) = window_start else { return false };
-    match handle.refs_as_of(ws).await {
-        Ok((_, bar)) => base_seq <= bar.max(1),
-        Err(_) => false,
-    }
-}
-
-/// What the next slot of each strategy will run — so Sunday's base rebuild is
-/// visible in the plan before it happens. Host = the live maintainer that can
-/// run it (ssd for a base rebuild). Wall-time estimate for a rebuild scales
-/// the 2026-08-21 prod rebuild (32.4 GB base → 31 min end to end incl. the
-/// 10-min history pack ≈ 1 min/GB).
-#[derive(Debug, Clone, serde::Serialize)]
-pub struct Upcoming {
-    pub strategy: String,
-    pub kind: String,
-    /// Next slot epoch (after now).
-    pub slot: u64,
-    /// e.g. `base rebuild (~25 min on the ssd host) + compose`
-    pub unit: String,
-    pub host: Option<String>,
-}
-
-pub async fn upcoming(
-    handle: &walgit_wal::RepoHandle,
-    cfg: &walgit_config::Config,
-    heartbeats: &[walgit_proto::v1::MaintainerHeartbeat],
-    now: SystemTime,
-) -> Vec<Upcoming> {
-    let id = handle.id();
-    let live: Vec<&walgit_proto::v1::MaintainerHeartbeat> = heartbeats
-        .iter()
-        .filter(|h| {
-            walgit_config::repo_listed(&h.repos, id.owner(), id.name())
-                && !walgit_config::repo_listed(&h.exclude, id.owner(), id.name())
-        })
-        .filter(|h| {
-            h.last_pass_at
-                .as_ref()
-                .map(walgit_proto::time::to_system)
-                .and_then(|t| now.duration_since(t).ok())
-                .is_some_and(|d| d.as_secs() < 600)
-        })
-        .collect();
-    let ssd = live
-        .iter()
-        .find(|h| h.disk == "ssd")
-        .map(|h| h.host.clone());
-    let any = live.first().map(|h| h.host.clone());
-    let m = handle.manifest();
-    let many = walgit_wal::base_packs(&m).len() > 1;
-    let base = walgit_wal::base_pack(&m).cloned();
-    let mut out = Vec::new();
-    for strat in &cfg.bundles.strategy {
-        let Ok(sched) = walgit_bundle::schedule::parse_schedule(&strat.schedule) else {
-            continue;
-        };
-        let Some(next) = walgit_bundle::schedule::next_fire_after(&sched, now) else {
-            continue;
-        };
-        let slot = next
-            .duration_since(SystemTime::UNIX_EPOCH)
-            .map_or(0, |d| d.as_secs());
-        let (unit, host) = match strat.kind {
-            walgit_config::BundleKind::Full => match &base {
-                Some(b) if many || base_predates_window(handle, strat, slot, b.seq).await => {
-                    let gib = b.pack_size as f64 / (1u64 << 30) as f64;
-                    let mins = (gib * 1.0).max(1.0).round() as u64;
-                    match &ssd {
-                        Some(h) => (format!("base rebuild (repack {gib:.1} GiB, ~{mins} min on {h}) + compose"), Some(h.clone())),
-                        None => ("base rebuild needed — NO ssd maintainer alive; the slot would compose the stale base".to_string(), None),
-                    }
-                }
-                Some(b) => (
-                    format!(
-                        "compose header ∘ base pack-{} (no push since it)",
-                        &b.checksum[..12]
-                    ),
-                    any.clone(),
-                ),
-                None => (
-                    "full bundle (pack-objects of the history)".to_string(),
-                    any.clone(),
-                ),
-            },
-            walgit_config::BundleKind::Incremental => (
-                if strat.chain {
-                    format!(
-                        "incremental on the previous {} (chained; on {}'s newest after a new one) (unless unchanged / under min_commits)",
-                        strat.name,
-                        strat.base.as_deref().unwrap_or("?")
-                    )
-                } else {
-                    format!(
-                        "incremental on {}'s newest (unless unchanged / under min_commits)",
-                        strat.base.as_deref().unwrap_or("?")
-                    )
-                },
-                any.clone(),
-            ),
-        };
-        out.push(Upcoming {
-            strategy: strat.name.clone(),
-            kind: format!("{:?}", strat.kind).to_lowercase(),
-            slot,
-            unit,
-            host,
-        });
-    }
-    out
-}
-
 /// One pass: one unit per assigned repository.
 pub async fn run_pass(state: &Arc<AppState>) -> anyhow::Result<PassReport> {
     let mut report = PassReport::default();
@@ -565,120 +235,73 @@ pub async fn run_pass(state: &Arc<AppState>) -> anyhow::Result<PassReport> {
             break;
         }
         report.repos += 1;
-        // One bounded unit of real work per repository per pass. A bundle slot
-        // that turns out to have nothing to cut (too small, no state as of the
-        // slot) is not work: re-plan at once instead of spending a whole pass
-        // per stale slot (a large repository after the 08-21 restart: ~30 such slots stood
-        // between the loop and the 05:00 hourly).
-        let mut skipped_slots = 0u32;
-        loop {
-            let before_bundles = report.bundles;
-            let unit = match next_unit(state, &id).await {
-                Ok(u) => u,
-                Err(e) => {
-                    warn!(repo = %id, error = %e, "maintenance: planning failed");
-                    report.skipped += 1;
-                    break;
-                }
-            };
-            if matches!(unit, Unit::Idle | Unit::NotAssigned) {
-                break;
+        let unit = match next_unit(state, &id).await {
+            Ok(u) => u,
+            Err(e) => {
+                warn!(repo = %id, error = %e, "maintenance: planning failed");
+                report.skipped += 1;
+                continue;
             }
-            let (kind, strategy, slot) = match &unit {
-                Unit::Checkpoint(_) => ("checkpoint", None, None),
-                Unit::BundleSlot(s, slot) => ("bundle", Some(s.clone()), Some(*slot)),
-                Unit::Compact => ("compact", None, None),
-                Unit::Repair(_) => ("repair", None, None),
-                Unit::BaseRebuild(s, slot) => ("base-rebuild", Some(s.clone()), Some(*slot)),
-                Unit::RevIndex(_) => ("rev-index", None, None),
-                Unit::Fsck(_) => ("fsck", None, None),
-                Unit::Idle | Unit::NotAssigned => unreachable!(),
-            };
-            let unit_span = tracing::info_span!("maintain.unit", repo = %id, kind, strategy = strategy.as_deref().unwrap_or(""), slot = slot.unwrap_or(0), outcome = tracing::field::Empty);
-            let t_unit = Instant::now();
-            let done = async {
-                match &unit {
-                    Unit::Checkpoint(trigger) => {
-                        let mut params = HashMap::new();
-                        params.insert("trigger".to_string(), trigger.clone());
-                        let ok = run_op(state, &id, "checkpoint", params).await;
-                        if ok {
-                            report.checkpoints += 1;
-                        }
-                        ok
-                    }
-                    Unit::BundleSlot(strategy, slot) => {
-                        let mut params = HashMap::new();
-                        params.insert("strategy".to_string(), strategy.clone());
-                        params.insert("slot".to_string(), slot.to_string());
-                        let value = run_op_value(state, &id, "bundle", params).await;
-                        // `bundles` counts bundles that exist now, not slots visited
-                        // (a visited slot with nothing to cut is re-planned at once).
-                        if value
-                            .as_ref()
-                            .and_then(|v| v.get("built"))
-                            .and_then(serde_json::Value::as_bool)
-                            .unwrap_or(false)
-                        {
-                            report.bundles += 1;
-                        }
-                        value.is_some()
-                    }
-                    Unit::Compact => {
-                        let ok = run_op(state, &id, "compact", HashMap::new()).await;
-                        if ok {
-                            report.compactions += 1;
-                        }
-                        ok
-                    }
-                    Unit::Repair(_) => run_op(state, &id, "repair", HashMap::new()).await,
-                    Unit::BaseRebuild(..) => {
-                        let mut params = HashMap::new();
-                        params.insert("base".to_string(), "1".to_string());
-                        params.insert("force".to_string(), "1".to_string());
-                        let ok = run_op(state, &id, "compact", params).await;
-                        if ok {
-                            report.compactions += 1;
-                        }
-                        ok
-                    }
-                    Unit::RevIndex(checksum) => {
-                        let mut params = HashMap::new();
-                        params.insert("pack".to_string(), checksum.clone());
-                        run_op(state, &id, "rev-index", params).await
+        };
+        if matches!(unit, Unit::Idle | Unit::NotAssigned) {
+            continue;
+        }
+        let kind = match &unit {
+            Unit::Checkpoint(_) => "checkpoint",
+            Unit::Compact => "compact",
+            Unit::Repair(_) => "repair",
+            Unit::RevIndex(_) => "rev-index",
+            Unit::Fsck(_) => "fsck",
+            Unit::Idle | Unit::NotAssigned => unreachable!(),
+        };
+        let unit_span =
+            tracing::info_span!("maintain.unit", repo = %id, kind, outcome = tracing::field::Empty);
+        let t_unit = Instant::now();
+        let done = async {
+            match &unit {
+                Unit::Checkpoint(trigger) => {
+                    let mut params = HashMap::new();
+                    params.insert("trigger".to_string(), trigger.clone());
+                    let ok = run_op(state, &id, "checkpoint", params).await;
+                    if ok {
+                        report.checkpoints += 1;
                     }
-                    Unit::Fsck(why) => {
-                        let mut params = HashMap::new();
-                        params.insert("connectivity".to_string(), "1".to_string());
-                        params.insert("why".to_string(), why.clone());
-                        run_op(state, &id, "fsck", params).await
+                    ok
+                }
+                Unit::Compact => {
+                    let ok = run_op(state, &id, "compact", HashMap::new()).await;
+                    if ok {
+                        report.compactions += 1;
                     }
-                    Unit::Idle | Unit::NotAssigned => false,
+                    ok
                 }
+                Unit::Repair(_) => run_op(state, &id, "repair", HashMap::new()).await,
+                Unit::RevIndex(checksum) => {
+                    let mut params = HashMap::new();
+                    params.insert("pack".to_string(), checksum.clone());
+                    run_op(state, &id, "rev-index", params).await
+                }
+                Unit::Fsck(why) => {
+                    let mut params = HashMap::new();
+                    params.insert("connectivity".to_string(), "1".to_string());
+                    params.insert("why".to_string(), why.clone());
+                    run_op(state, &id, "fsck", params).await
+                }
+                Unit::Idle | Unit::NotAssigned => false,
             }
-            .instrument(unit_span.clone())
-            .await;
-            let outcome = if done { "ok" } else { "failed" };
-            unit_span.record("outcome", outcome);
-            metrics::counter!("walgit_maintain_units_total", "host" => host_name(state), "kind" => kind, "outcome" => outcome).increment(1);
-            metrics::histogram!("walgit_maintain_unit_seconds", "kind" => kind)
-                .record(t_unit.elapsed().as_secs_f64());
-            if done {
-                report.units += 1;
-                report.last_unit = Some(format!("{id} {unit:?}"));
-            } else {
-                report.skipped += 1;
-            }
-            let was_bundle = matches!(unit, Unit::BundleSlot(..));
-            if done
-                && was_bundle
-                && report.bundles == before_bundles
-                && skipped_slots < SKIP_THROUGH_MAX
-            {
-                skipped_slots += 1;
-                continue;
-            }
-            break;
+        }
+        .instrument(unit_span.clone())
+        .await;
+        let outcome = if done { "ok" } else { "failed" };
+        unit_span.record("outcome", outcome);
+        metrics::counter!("walgit_maintain_units_total", "host" => host_name(state), "kind" => kind, "outcome" => outcome).increment(1);
+        metrics::histogram!("walgit_maintain_unit_seconds", "kind" => kind)
+            .record(t_unit.elapsed().as_secs_f64());
+        if done {
+            report.units += 1;
+            report.last_unit = Some(format!("{id} {unit:?}"));
+        } else {
+            report.skipped += 1;
         }
     }
     Ok(report)
diff --git a/crates/walgit-server/src/ops.rs b/crates/walgit-server/src/ops.rs
index 659cb90..fcd2edf 100644
--- a/crates/walgit-server/src/ops.rs
+++ b/crates/walgit-server/src/ops.rs
@@ -1,5 +1,5 @@
 //! Repository maintenance operations ("make the repo great"): fsck, compaction,
-//! bundle builds, checkpoints, re-materialize. Shared by the background loops
+//! checkpoints, re-materialize. Shared by the background loops
 //! (`walgit serve` roles), the CLI, and the web UI's `POST …/ops/{op}` route,
 //! which streams the op's log as SSE and records the outcome per instance.
 
@@ -10,8 +10,8 @@ use tracing::Instrument;
 
 use prost::Message;
 use serde::Serialize;
-use walgit_config::Config;
-use walgit_git::{RepackMode, RepackOptions, RepoId};
+
+use walgit_git::RepoId;
 use walgit_store::ObjectStoreExt;
 use walgit_wal::RepoHandle;
 
@@ -87,23 +87,15 @@ pub const OPS: &[OpSpec] = &[
     OpSpec {
         id: "compact",
         label: "Compact",
-        description: "Geometric repack (or full base rebuild with bitmaps) under the per-repo compaction lease, \
-                      published as a COMPACT WAL entry. force=1 ignores the trigger thresholds; base=1 forces a bitmap'd base rebuild.",
+        description: "Run one conserving pack lifecycle unit under the per-repository lease. \
+                      force=1 ignores fold thresholds; base=1 requests a whole-cut re-segmentation.",
         params: &["force", "base"],
         mutating: true,
     },
-    OpSpec {
-        id: "bundle",
-        label: "Bundle",
-        description: "Build and publish a bundle-uri bundle now (strategy=<name>, default: the first full strategy; \
-                      strategy=due builds whatever the schedule says is due).",
-        params: &["strategy"],
-        mutating: true,
-    },
     OpSpec {
         id: "checkpoint",
         label: "Checkpoint",
-        description: "Write a checkpoint (pack set + ref snapshot) at the current head so cold materialize and bundles start from here.",
+        description: "Write a checkpoint (pack set + ref snapshot) at the current head so cold materialize starts from here.",
         params: &[],
         mutating: true,
     },
@@ -421,7 +413,6 @@ async fn run(
             let base = flag(params, "base");
             let out = compact_repo(
                 &handle,
-                &state.cfg,
                 CompactRequest {
                     force,
                     rebuild_base: base,
@@ -433,131 +424,6 @@ async fn run(
             let summary = out.summary();
             Ok((summary, serde_json::to_value(&out).unwrap_or_default()))
         }
-        "bundle" => {
-            if !state.cfg.bundles.enabled {
-                return Err("bundles are disabled in config".into());
-            }
-            let strategy = params.get("strategy").cloned().unwrap_or_default();
-            if let Some(slot) = params.get("slot").and_then(|v| v.parse::<u64>().ok()) {
-                // One calendar slot (the maintenance loop's unit): content as of the slot.
-                log(format!(
-                    "building {strategy} slot {slot} ({})",
-                    walgit_bundle::slots::from_epoch(slot)
-                        .duration_since(std::time::UNIX_EPOCH)
-                        .map_or(0, |d| d.as_secs())
-                ));
-                // A FULL slot of a repository that has a tier-2 base is a compose
-                // of that base (header = refs at the base's seq) — never a
-                // `pack-objects` of the whole history into a file (a large repository: 32 GB
-                // through this host). The maintainer rebuilds the base first on
-                // an ssd host when pushes landed since (`Unit::BaseRebuild`).
-                let cfg_eff = handle.effective_config();
-                let is_full = cfg_eff
-                    .bundles
-                    .strategy
-                    .iter()
-                    .any(|s| s.name == strategy && s.kind == walgit_config::BundleKind::Full);
-                if is_full && walgit_wal::base_pack(&handle.manifest()).is_some() {
-                    log(format!(
-                        "{strategy} slot {slot}: composing header ∘ tier-2 base (no bytes through this host)"
-                    ));
-                    let e = crate::bundles::compose_full_from_base(
-                        &state.registry,
-                        id,
-                        &strategy,
-                        &cfg_eff,
-                        slot,
-                    )
-                    .await
-                    .map_err(|e| e.to_string())?;
-                    state.caches.bundle_list.invalidate(&id.to_string());
-                    return Ok((
-                        format!(
-                            "slot {} {} composed: {} bytes at seq {}, token {}",
-                            e.strategy, slot, e.size, e.seq, e.creation_token
-                        ),
-                        serde_json::json!({ "id": e.id, "strategy": e.strategy, "slot": slot, "size": e.size, "seq": e.seq, "key": e.key, "built": true, "composed": true }),
-                    ));
-                }
-                let entry = state
-                    .bundles
-                    .build_slot_unit(id, &strategy, slot)
-                    .await
-                    .map_err(|e| e.to_string())?;
-                // The list changed (or a skip was recorded): this host's next
-                // `GET bundles/list` must show it, not a cached render.
-                state.caches.bundle_list.invalidate(&id.to_string());
-                return Ok(match entry {
-                    Some(e) => (
-                        format!(
-                            "slot {} {} built: {} bytes at seq {}, token {}",
-                            e.strategy, slot, e.size, e.seq, e.creation_token
-                        ),
-                        serde_json::json!({ "id": e.id, "strategy": e.strategy, "slot": slot, "size": e.size, "seq": e.seq, "key": e.key, "built": true }),
-                    ),
-                    None => (
-                        format!(
-                            "slot {strategy} {slot}: nothing to build (built elsewhere, no new objects, or no refs at that time)"
-                        ),
-                        serde_json::json!({ "slot": slot, "built": false }),
-                    ),
-                });
-            }
-            if strategy == "due" {
-                log("building all due bundle strategies".into());
-                let entries = state
-                    .bundles
-                    .run_due(id, std::time::SystemTime::now())
-                    .await
-                    .map_err(|e| e.to_string())?;
-                for e in &entries {
-                    log(format!(
-                        "built {} ({} bytes, token {})",
-                        e.strategy, e.size, e.creation_token
-                    ));
-                }
-                state.caches.bundle_list.invalidate(&id.to_string());
-                let names: Vec<String> = entries.iter().map(|e| e.strategy.clone()).collect();
-                return Ok((
-                    format!("built {} due bundle(s)", entries.len()),
-                    serde_json::json!({ "built": names }),
-                ));
-            }
-            let strategy = if strategy.is_empty() {
-                state
-                    .cfg
-                    .bundles
-                    .strategy
-                    .iter()
-                    .find(|s| s.kind == walgit_config::BundleKind::Full)
-                    .or(state.cfg.bundles.strategy.first())
-                    .map(|s| s.name.clone())
-                    .ok_or_else(|| "no bundle strategies configured".to_string())?
-            } else {
-                strategy
-            };
-            log(format!(
-                "building bundle strategy {strategy} (git bundle create on the local copy, upload, CAS list)"
-            ));
-            let entry = state
-                .bundles
-                .build(id, &strategy)
-                .await
-                .map_err(|e| e.to_string())?;
-            state.caches.bundle_list.invalidate(&id.to_string());
-            let summary = format!(
-                "bundle {} built: {} bytes at seq {}, creationToken {}",
-                entry.strategy, entry.size, entry.seq, entry.creation_token
-            );
-            Ok((
-                summary,
-                serde_json::json!({
-                    "id": entry.id, "strategy": entry.strategy, "kind": entry.kind,
-                    "size": entry.size, "seq": entry.seq, "creation_token": entry.creation_token,
-                    "key": entry.key,
-                }),
-            ))
-        }
         "checkpoint" => {
             // Refs-level: a checkpoint is manifest + ref snapshot, it never
             // needs the packs on this instance (works for a large repository on a front).
@@ -610,7 +476,7 @@ async fn run(
 pub struct CompactRequest {
     /// Ignore the trigger thresholds.
     pub force: bool,
-    /// Force a full base rebuild (one pack + bitmap).
+    /// Force a conserving re-segmentation of the committed object set.
     pub rebuild_base: bool,
 }
 
@@ -648,9 +514,9 @@ impl CompactOutcome {
             } => format!(
                 "{} published: {} pack(s) at tier {tier}, superseding {superseded}",
                 if *rebuild_base {
-                    "base rebuild"
+                    "whole-cut re-segmentation"
                 } else {
-                    "geometric compaction"
+                    "pack lifecycle unit"
                 },
                 packs.len()
             ),
@@ -658,210 +524,78 @@ impl CompactOutcome {
     }
 }
 
-/// Decide whether `handle` needs compaction, take the per-repo lease, repack
-/// Whether the compaction trigger fires for `handle` (same rule as
-/// [`compact_repo`] without `force`; base rebuilds are the VM job's on tmpfs hosts).
-pub fn compaction_triggered(handle: &RepoHandle, cfg: &Config) -> bool {
-    let manifest = handle.manifest();
-    let tier0: Vec<_> = manifest.packs.iter().filter(|p| p.tier == 0).collect();
-    let tier0_bytes: u64 = tier0.iter().map(|p| p.pack_size).sum();
-    fold_due(tier0.len(), tier0_bytes, cfg)
-}
-
-/// Geometric folding is due when the fresh tier is over its count or byte trigger **and there is
-/// something to fold**: one pack folds into itself (`git repack --geometric` writes nothing), so a
-/// single big tier-0 pack — an import that never became a base — must not make every maintainer
-/// pass run a 5 s no-op compaction (acme/large, 11.9 GB, 2026-08-22).
-pub fn fold_due(tier0_count: usize, tier0_bytes: u64, cfg: &Config) -> bool {
-    tier0_count >= 2
-        && (tier0_count >= cfg.compaction.trigger_packs
-            || tier0_bytes >= cfg.compaction.trigger_bytes.as_u64())
-}
-
-/// the local copy and publish the result as a COMPACT entry.
+/// Run one desired-state pack unit under the repository lease. Planning reads
+/// validated committed settings before any bulk materialization.
 pub async fn compact_repo(
     handle: &RepoHandle,
-    cfg: &Config,
     req: CompactRequest,
     log: Log<'_>,
 ) -> anyhow::Result<CompactOutcome> {
-    // Sync to get the latest manifest, then release the read guard: the
-    // publisher needs the repo lock and repack runs on the local copy anyway.
-    // A base rebuild rewrites every byte, so it needs real local copies (never
-    // a mount-linked base); geometric folding only touches tiers < 2.
-    if req.rebuild_base {
-        drop(handle.sync_full().await?);
-    } else {
-        drop(handle.sync().await?);
+    // A cancelled operation must also stop its heartbeat so the lease can expire.
+    struct Heartbeat(tokio::task::JoinHandle<()>);
+    impl Drop for Heartbeat {
+        fn drop(&mut self) {
+            self.0.abort();
+        }
     }
-
+    drop(handle.sync_refs().await?);
+    let cfg = handle.validated_effective_config()?;
+    anyhow::ensure!(
+        cfg.packs.enabled,
+        "pack maintenance is disabled by the effective repository settings"
+    );
     let manifest = handle.manifest();
-    let tier0_packs: Vec<_> = manifest.packs.iter().filter(|p| p.tier == 0).collect();
-    let tier0_count = tier0_packs.len();
-    let tier0_bytes: u64 = tier0_packs.iter().map(|p| p.pack_size).sum();
-    let base_bytes: u64 = manifest
-        .packs
-        .iter()
-        .filter(|p| p.tier == 2)
-        .map(|p| p.pack_size)
-        .sum();
-    let non_base_bytes: u64 = manifest
-        .packs
-        .iter()
-        .filter(|p| p.tier < 2)
-        .map(|p| p.pack_size)
-        .sum();
-    // The base (tier 2, one pack + bitmap) is rebuilt only when asked — the weekly slot's
-    // `BaseRebuild` unit on the ssd host or `walgit compact --base` (AGENTS §2.5) — never by a
-    // ratio inside the fold unit: on 2026-08-22 a redundant second full pack in a large repository's manifest
-    // made "non-base ≥ 0.5 × base" true forever and every Compact unit ran a 30-min `repack -adb`
-    // (7 × 32 GB packs in the bucket). Otherwise fold fresh packs geometrically into the medium tier.
-    let rebuild_base = req.rebuild_base;
-    let should_compact = req.force || fold_due(tier0_count, tier0_bytes, cfg) || rebuild_base;
-    log(format!(
-        "{} live packs: {tier0_count} fresh ({tier0_bytes} bytes), base {base_bytes} bytes, non-base {non_base_bytes} bytes; rebuild_base={rebuild_base}",
-        manifest.packs.len()
-    ));
-    if !should_compact {
-        return Ok(CompactOutcome::NotTriggered {
-            tier0_packs: tier0_count,
-            tier0_bytes,
-        });
+    let fresh: Vec<_> = manifest.packs.iter().filter(|p| p.tier == 0).collect();
+    let not_triggered = || CompactOutcome::NotTriggered {
+        tier0_packs: fresh.len(),
+        tier0_bytes: fresh.iter().map(|p| p.pack_size).sum(),
+    };
+    if !req.force
+        && !req.rebuild_base
+        && crate::pack_lifecycle::plan(&manifest, &cfg, std::time::SystemTime::now()).is_none()
+    {
+        return Ok(not_triggered());
     }
-
-    // Per-repo lease (the store handle is prefixed with the repo key).
-    let lease_key = walgit_proto::keys::lease_key("compact");
-    let holder = walgit_store::coord::instance_id();
-    let lease_store: walgit_store::DynStore = Arc::new(handle.store().clone());
-    let lease = walgit_store::coord::try_acquire(
-        lease_store,
-        &lease_key,
-        holder,
-        "compact",
-        cfg.compaction.lease_ttl,
+    let store: walgit_store::DynStore = Arc::new(handle.store().clone());
+    let Some(lease) = walgit_store::coord::try_acquire(
+        store,
+        &walgit_proto::keys::lease_key("compact"),
+        walgit_store::coord::instance_id(),
+        "pack lifecycle",
+        cfg.packs.lease_ttl,
     )
-    .await?;
-    let Some(lease) = lease else {
+    .await?
+    else {
         return Ok(CompactOutcome::LeaseHeld);
     };
-
-    // A geometric fold never touches the base or a history pack (D18): both are `--keep-pack`'d.
-    // On 2026-08-22 a fold on the SSD host (every pack a real local file) rolled a large repository's 32 GB base
-    // and its 6 GB history pack into a tier-1 pack (seq 101) — no history pack for a day, and
-    // the chain of consequences above.
-    let protected: Vec<gix_hash::ObjectId> = manifest
-        .packs
-        .iter()
-        .filter(|p| p.tier == 2 || p.kind == walgit_proto::v1::PackKind::History as i32)
-        .filter_map(|p| gix_hash::ObjectId::from_hex(p.checksum.as_bytes()).ok())
-        .collect();
-    // Base rebuild: resumable, in a scratch copy, serving copy never rewritten (`rebuild.rs`,
-    // BUNDLE_URI_DESIGN §5a). It installs + publishes itself; the lease is ours until it returns.
-    if rebuild_base {
-        log("lease acquired; base rebuild in a scratch copy (resumable)".to_string());
-        let out = crate::rebuild::rebuild_base(handle, cfg, log).await;
-        if let Err(e) = lease.release().await {
-            log(format!("lease release failed: {e}"));
-        }
-        let out = out?;
-        if out.resumed {
-            log("rebuild resumed an earlier interrupted run".to_string());
-        }
-        return Ok(CompactOutcome::Published {
-            rebuild_base: true,
-            tier: 2,
-            packs: out.packs,
-            superseded: out.superseded,
-        });
-    }
-
-    let repack_opts = RepackOptions {
-        mode: RepackMode::Geometric {
-            factor: cfg.compaction.factor,
-        },
-        write_bitmap: false,
-        write_midx: true,
-        keep: protected,
-    };
-    let tier = 1u32;
-    log("lease acquired; running git repack -d --geometric --write-midx".to_string());
-    let t = Instant::now();
-    let result = match handle.local().repack(repack_opts).await {
-        Ok(r) => r,
-        Err(e) => {
-            let _ = lease.release().await;
-            return Err(e.into());
-        }
-    };
-    log(format!(
-        "repack done in {:.1}s: {} new pack(s), {} removed",
-        t.elapsed().as_secs_f64(),
-        result.new_packs.len(),
-        result.removed.len()
+    let lease = Arc::new(tokio::sync::Mutex::new(lease));
+    let mut heartbeat = Heartbeat(walgit_store::coord::LeaseGuard::spawn_heartbeat(
+        lease.clone(),
+        (cfg.packs.lease_ttl / 3).max(std::time::Duration::from_millis(1)),
+        cfg.packs.lease_ttl,
     ));
-
-    // Geometric: the new pack(s) supersede exactly what git removed — of the packs the manifest
-    // lists (a stale local file nobody advertises is not a supersede).
-    let live: std::collections::HashSet<String> =
-        manifest.packs.iter().map(|p| p.checksum.clone()).collect();
-    let supersedes: Vec<gix_hash::ObjectId> = result
-        .removed
-        .iter()
-        .copied()
-        .filter(|c| live.contains(&c.to_hex().to_string()))
-        .collect();
-    let superseded = supersedes.len();
-    let mut supersedes_left = Some(supersedes);
-    let mut packs = Vec::new();
-    let mut first_err = None;
-    for p in &result.new_packs {
-        let hex = p.checksum.to_hex().to_string();
-        let size = p.pack_size;
-        match handle
-            .publish_compact(p.clone(), supersedes_left.take().unwrap_or_default(), tier)
-            .await
-        {
-            Ok(seq) => {
-                log(format!("published pack {hex} ({size} bytes) as seq {seq}"));
-                packs.push(hex);
-            }
-            Err(e) => {
-                log(format!("publish_compact failed for {hex}: {e}"));
-                first_err.get_or_insert(e);
+    log("lease acquired; running one isolated pack lifecycle unit".into());
+    let result =
+        crate::pack_lifecycle::run(handle, &cfg, req.force, req.rebuild_base, log, &lease).await;
+    heartbeat.0.abort();
+    let _ = (&mut heartbeat.0).await;
+    if let Ok(lease) = Arc::try_unwrap(lease)
+        && let Err(error) = lease.into_inner().release().await
+    {
+        log(format!("lease release failed: {error}"));
+    }
+    match result? {
+        None => Ok(not_triggered()),
+        Some(out) => {
+            if out.resumed {
+                log("resumed validated pack lifecycle progress".into());
             }
+            Ok(CompactOutcome::Published {
+                rebuild_base: req.rebuild_base,
+                tier: out.tier,
+                packs: out.packs,
+                superseded: out.superseded,
+            })
         }
     }
-    if let Err(e) = lease.release().await {
-        log(format!("lease release failed: {e}"));
-    }
-    if let Some(e) = first_err {
-        return Err(e.into());
-    }
-    Ok(CompactOutcome::Published {
-        rebuild_base: false,
-        tier,
-        packs,
-        superseded,
-    })
-}
-
-#[cfg(test)]
-mod fold_tests {
-    use super::fold_due;
-
-    #[test]
-    fn one_fresh_pack_never_triggers_folding_however_large() {
-        let cfg = walgit_config::Config::default(); // trigger_packs 16, trigger_bytes 1 GiB
-        assert!(
-            !fold_due(1, 11_891_739_367, &cfg),
-            "a single 11.9 GB import pack folds into itself"
-        );
-        assert!(!fold_due(0, 0, &cfg));
-        assert!(
-            fold_due(2, 2 << 30, &cfg),
-            "two packs over the byte trigger"
-        );
-        assert!(fold_due(16, 1024, &cfg), "count trigger");
-        assert!(!fold_due(15, 1024, &cfg));
-    }
 }
diff --git a/crates/walgit-server/src/pack_lifecycle.rs b/crates/walgit-server/src/pack_lifecycle.rs
new file mode 100644
index 0000000..31cbe5b
--- /dev/null
+++ b/crates/walgit-server/src/pack_lifecycle.rs
@@ -0,0 +1,831 @@
+//! Maintenance choices from committed pack inventory. Layout thresholds are
+//! independent of graph certificates: a missing proof never requests a full cut.
+use std::collections::BTreeMap;
+use std::time::{Duration, SystemTime};
+
+use walgit_config::{Config, packs::FoldInventory};
+use walgit_proto::v1::{Manifest, PackKind, PackRef};
+
+/// One bounded maintenance decision. The worker captures and rechecks inputs
+/// again under its lease; these checksums are never publication authority.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Work {
+    Classify(Vec<String>),
+    Fold(Vec<String>),
+    Freeze(String),
+    FirstFreeze,
+    Resegment,
+    RepairCoverage,
+}
+
+#[cfg(test)]
+mod planner_tests {
+    use super::*;
+
+    #[test]
+    fn count_trigger_does_not_rewrite_a_disproportionately_large_buffer() {
+        let cfg = Config::default();
+        let policy = cfg.refs.policy_identity();
+        let mut manifest = Manifest::default();
+        for n in 0..16 {
+            manifest.packs.push(PackRef {
+                checksum: format!("{n:040x}"),
+                pack_size: 100,
+                pack_groups: vec!["code".into()],
+                ref_policy: policy.clone(),
+                ..Default::default()
+            });
+        }
+        for (n, bytes) in [(16, 2000), (17, 1_000_000)] {
+            manifest.packs.push(PackRef {
+                checksum: format!("{n:040x}"),
+                pack_size: bytes,
+                tier: 1,
+                pack_groups: vec!["code".into()],
+                ref_policy: policy.clone(),
+                ..Default::default()
+            });
+        }
+        let Some(Work::Fold(selected)) = plan(&manifest, &cfg, SystemTime::now()) else {
+            panic!("fresh count should trigger a fold");
+        };
+        assert_eq!(selected.len(), 17);
+        assert!(selected.contains(&format!("{:040x}", 16)));
+        assert!(!selected.contains(&format!("{:040x}", 17)));
+    }
+}
+
+fn age(pack: &PackRef, manifest: &Manifest, now: SystemTime) -> Duration {
+    // Old descriptors have no publication timestamp. The last committed
+    // manifest mutation is a conservative lower bound on their age.
+    pack.published_at
+        .or(manifest.updated_at)
+        .as_ref()
+        .map(walgit_proto::time::to_system)
+        .and_then(|at| now.duration_since(at).ok())
+        .unwrap_or_default()
+}
+
+fn redundant_history(pack: &PackRef) -> bool {
+    pack.kind == PackKind::History as i32
+        && pack.pack_groups.is_empty()
+        && !pack.derived_from.is_empty()
+}
+
+/// Select one unit, with separate families for each group/type/audience tuple.
+/// Frozen packs never enter a fold, and an idle repository is not recut by age.
+pub fn plan(manifest: &Manifest, cfg: &Config, now: SystemTime) -> Option<Work> {
+    if !cfg.packs.enabled || manifest.packs.is_empty() {
+        return None;
+    }
+    let policy = cfg.refs.policy_identity();
+    let unclassified: Vec<_> = manifest
+        .packs
+        .iter()
+        .filter(|p| !redundant_history(p))
+        .filter(|p| {
+            p.pack_groups.is_empty() || (p.pack_groups != ["_retained"] && p.ref_policy != policy)
+        })
+        .take(128)
+        .map(|p| p.checksum.clone())
+        .collect();
+    if !unclassified.is_empty() {
+        return Some(Work::Classify(unclassified));
+    }
+
+    let live_bytes = manifest
+        .packs
+        .iter()
+        .filter(|p| !redundant_history(p))
+        .map(|p| p.pack_size)
+        .sum();
+    let floor = cfg.packfile_uri.uri_min_bytes.as_u64();
+    let mut families: BTreeMap<(Vec<String>, i32, i32), Vec<&PackRef>> = BTreeMap::new();
+    for pack in manifest
+        .packs
+        .iter()
+        .filter(|p| p.tier < 2 && !redundant_history(p))
+    {
+        families
+            .entry((pack.pack_groups.clone(), pack.kind, pack.audience))
+            .or_default()
+            .push(pack);
+    }
+    for packs in families.values() {
+        let fresh: Vec<_> = packs.iter().filter(|p| p.tier == 0).collect();
+        let inventory = FoldInventory {
+            live_bytes,
+            fresh_bytes: fresh.iter().map(|p| p.pack_size).sum(),
+            fresh_packs: fresh.len(),
+            oldest_fresh_age: fresh
+                .iter()
+                .map(|p| age(p, manifest, now))
+                .max()
+                .unwrap_or_default(),
+        };
+        if cfg.packs.fold_reason(&inventory, floor).is_some() {
+            let mut selected: Vec<_> = fresh.iter().map(|p| p.checksum.clone()).collect();
+            let mut size: u64 = fresh.iter().map(|p| p.pack_size).sum();
+            let mut buffers: Vec<_> = packs.iter().filter(|p| p.tier == 1).collect();
+            buffers.sort_by_key(|p| p.pack_size);
+            for buffer in buffers {
+                if buffer.pack_size > size.saturating_mul(u64::from(cfg.packs.geometric_factor)) {
+                    break;
+                }
+                size = size.saturating_add(buffer.pack_size);
+                selected.push(buffer.checksum.clone());
+            }
+            return Some(Work::Fold(selected));
+        }
+    }
+    for pack in manifest.packs.iter().filter(|p| p.tier == 1) {
+        if cfg
+            .packs
+            .freeze_reason(pack.pack_size, age(pack, manifest, now), floor)
+            .is_some()
+        {
+            return Some(Work::Freeze(pack.checksum.clone()));
+        }
+    }
+    let frozen: Vec<_> = manifest
+        .packs
+        .iter()
+        .filter(|p| p.tier == 2 && !redundant_history(p))
+        .collect();
+    let frozen_bytes = frozen.iter().map(|p| p.pack_size).sum();
+    if cfg.packs.first_freeze_due(live_bytes, frozen_bytes, floor) {
+        return Some(Work::FirstFreeze);
+    }
+    let global_bytes = frozen
+        .iter()
+        .filter(|p| p.derived_from.is_empty())
+        .map(|p| p.pack_size)
+        .sum();
+    let fold_bytes = frozen
+        .iter()
+        .filter(|p| !p.derived_from.is_empty())
+        .map(|p| p.pack_size)
+        .sum();
+    if cfg.packs.resegment_due(global_bytes, fold_bytes) {
+        return Some(Work::Resegment);
+    }
+
+    // Proof repair is its own metadata unit. Full graph validation belongs to
+    // that unit; this cheap hint does not claim readiness or pick a URI set.
+    let missing_proof = cfg.refs.packfiles.iter().any(|(name, group)| {
+        !group.include.is_empty()
+            && manifest.packs.iter().any(|p| p.pack_groups.contains(name))
+            && !manifest
+                .packs
+                .iter()
+                .flat_map(|p| &p.group_coverages)
+                .any(|c| c.group == *name && c.ref_policy == policy)
+    });
+    missing_proof.then_some(Work::RepairCoverage)
+}
+
+use crate::ops::Log;
+use anyhow::{Context, bail, ensure};
+use prost::Message;
+use std::path::{Path, PathBuf};
+use walgit_git::{maintenance_input, pack_segments};
+use walgit_proto::v1::{PackAudience, PackGroupCoverage};
+use walgit_wal::{PackClassification, PublicationView, RepoHandle};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Phase {
+    Prepared,
+    Step,
+    Sealed,
+}
+pub static TEST_ABORT_AFTER: parking_lot::Mutex<Option<(String, Phase)>> =
+    parking_lot::Mutex::new(None);
+fn abort_after(handle: &RepoHandle, phase: Phase) -> anyhow::Result<()> {
+    if TEST_ABORT_AFTER
+        .lock()
+        .as_ref()
+        .is_some_and(|(repo, p)| *repo == handle.id().to_string() && *p == phase)
+    {
+        bail!("pack lifecycle aborted by test hook after {phase:?}");
+    }
+    Ok(())
+}
+
+pub struct Outcome {
+    pub packs: Vec<String>,
+    pub superseded: usize,
+    pub tier: u32,
+    pub resumed: bool,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct Receipt {
+    group: String,
+    kind: i32,
+    outputs: Vec<OutputReceipt>,
+}
+#[derive(serde::Serialize, serde::Deserialize)]
+struct OutputReceipt {
+    descriptor: Vec<u8>,
+    path: PathBuf,
+    exceeds_target: bool,
+}
+#[derive(serde::Serialize, serde::Deserialize)]
+struct Journal {
+    root: PathBuf,
+    manifest: Vec<u8>,
+    refs: Vec<u8>,
+    policy: String,
+    tuning: String,
+    selected: Vec<String>,
+    tier: u32,
+    global: bool,
+    metadata: bool,
+    receipts: Vec<Receipt>,
+}
+fn journal_path(handle: &RepoHandle, cfg: &Config) -> PathBuf {
+    cfg.cache
+        .dir
+        .join("_pack-lifecycle")
+        .join(handle.id().owner())
+        .join(format!("{}.json", handle.id().name()))
+}
+async fn save_journal(path: &Path, journal: &Journal) -> anyhow::Result<()> {
+    tokio::fs::create_dir_all(path.parent().context("journal parent")?).await?;
+    let tmp = path.with_extension("json.tmp");
+    tokio::fs::write(&tmp, serde_json::to_vec(journal)?).await?;
+    tokio::fs::rename(tmp, path).await?;
+    Ok(())
+}
+fn compatible(
+    journal: &Journal,
+    current: &PublicationView,
+    tuning: &str,
+) -> anyhow::Result<PublicationView> {
+    ensure!(
+        journal.policy == current.config.refs.policy_identity() && journal.tuning == tuning,
+        "scratch policy/tuning changed"
+    );
+    let manifest = Manifest::decode(journal.manifest.as_slice())?;
+    walgit_wal::validate_manifest(&manifest)?;
+    ensure!(
+        manifest.repo == current.manifest.repo,
+        "scratch repository changed"
+    );
+    let refs = walgit_proto::v1::RefSnapshot::decode(journal.refs.as_slice())?;
+    walgit_proto::snapshot::validate(&refs)?;
+    ensure!(
+        refs.refs == current.refs.refs
+            && refs.head_target == current.refs.head_target
+            && refs.object_format == current.refs.object_format
+            && refs.seq <= current.refs.seq,
+        "scratch refs changed"
+    );
+    // Every original input remains exact and committed. Additive outputs from
+    // this attempt are harmless; other new inputs require a fresh capture.
+    let output_ids = journal
+        .receipts
+        .iter()
+        .flat_map(|r| &r.outputs)
+        .map(|r| PackRef::decode(r.descriptor.as_slice()).map(|p| p.checksum))
+        .collect::<Result<std::collections::BTreeSet<_>, _>>()?;
+    for pack in &manifest.packs {
+        ensure!(
+            current.manifest.packs.iter().any(|p| p == pack),
+            "scratch input changed or retired"
+        );
+    }
+    ensure!(
+        current.manifest.packs.iter().all(|p| manifest
+            .packs
+            .iter()
+            .any(|old| old.checksum == p.checksum)
+            || output_ids.contains(&p.checksum)),
+        "new committed inputs require replanning"
+    );
+    Ok(PublicationView {
+        manifest: std::sync::Arc::new(manifest),
+        version: current.version.clone(),
+        refs,
+        config: current.config.clone(),
+    })
+}
+fn receipts(journal: &Journal, cfg: &Config) -> anyhow::Result<Vec<pack_segments::StepReceipt>> {
+    journal
+        .receipts
+        .iter()
+        .map(|r| {
+            let audience = cfg.refs.packfiles.get(&r.group).map(|g| g.kind);
+            Ok(pack_segments::StepReceipt {
+                group: r.group.clone(),
+                kind: PackKind::try_from(r.kind)?,
+                outputs: r
+                    .outputs
+                    .iter()
+                    .map(|o| {
+                        Ok(pack_segments::SegmentOutput {
+                            group: r.group.clone(),
+                            audience,
+                            dependencies: Vec::new(),
+                            pack: PackRef::decode(o.descriptor.as_slice())?,
+                            path: o.path.clone(),
+                            exceeds_target: o.exceeds_target,
+                        })
+                    })
+                    .collect::<anyhow::Result<_>>()?,
+            })
+        })
+        .collect()
+}
+
+/// One isolated, conserving unit. The lease heartbeat is managed by the caller;
+/// every publication also renews synchronously so a lost lease aborts the seal.
+pub async fn run(
+    handle: &RepoHandle,
+    cfg: &Config,
+    force: bool,
+    forced_full: bool,
+    log: Log<'_>,
+    lease: &tokio::sync::Mutex<walgit_store::coord::LeaseGuard>,
+) -> anyhow::Result<Option<Outcome>> {
+    drop(handle.sync_refs().await?);
+    let initial = handle.publication_view().await?;
+    let mut work = if forced_full {
+        Some(Work::Resegment)
+    } else {
+        plan(&initial.manifest, &initial.config, SystemTime::now())
+    };
+    if work.is_none() && force {
+        let mut families: BTreeMap<_, Vec<String>> = BTreeMap::new();
+        for p in initial
+            .manifest
+            .packs
+            .iter()
+            .filter(|p| p.tier < 2 && !redundant_history(p))
+        {
+            families
+                .entry((p.pack_groups.clone(), p.kind, p.audience))
+                .or_default()
+                .push(p.checksum.clone());
+        }
+        work = families
+            .into_values()
+            .find(|p| p.len() >= 2)
+            .map(Work::Fold);
+    }
+    let Some(work) = work else {
+        return Ok(None);
+    };
+    let bytes: u64 = initial
+        .manifest
+        .packs
+        .iter()
+        .map(|p| p.pack_size.saturating_add(p.idx_size))
+        .sum();
+    // Serving copy + isolated inputs + outputs coexist until the seal. This is
+    // conservative even when the filesystem supports reflinks.
+    let budget = cfg.cache_budget_bytes();
+    ensure!(
+        budget == 0 || bytes.saturating_mul(3) < budget,
+        "pack lifecycle needs isolated input/output headroom: {} bytes, budget {}",
+        bytes.saturating_mul(3),
+        budget
+    );
+    log(format!(
+        "pack lifecycle {work:?}: capturing {bytes} committed bytes in isolated scratch"
+    ));
+    drop(handle.sync_full().await?);
+    let current = handle.publication_view().await?;
+    let cpu = std::thread::available_parallelism().map_or(1, usize::from);
+    let memory = if budget == 0 {
+        cfg.packs.segment_delta_window_memory.as_u64()
+    } else {
+        budget.saturating_sub(bytes.saturating_mul(3)).max(1)
+    };
+    let delta = cfg.packs.delta_budget(cpu, memory)?;
+    let resources = pack_segments::Resources {
+        sort_memory_bytes: memory.clamp(1, 64 * 1024 * 1024),
+        delta_memory_bytes: delta
+            .window_memory_per_thread
+            .saturating_mul(delta.threads as u64),
+        threads: delta.threads,
+    };
+    let tuning = format!(
+        "{}\n{}:{}:{}",
+        toml::to_string(&cfg.packs)?,
+        resources.sort_memory_bytes,
+        resources.delta_memory_bytes,
+        resources.threads
+    );
+    let path = journal_path(handle, cfg);
+    let root = cfg.cache.dir.join("_pack-lifecycle").join("attempts");
+    tokio::fs::create_dir_all(&root).await?;
+    let old = tokio::fs::read(&path)
+        .await
+        .ok()
+        .and_then(|b| serde_json::from_slice::<Journal>(&b).ok());
+    let mut resumed = false;
+    let mut restored = None;
+    if let Some(journal) = old {
+        let attempt = async {
+            ensure!(
+                journal
+                    .root
+                    .canonicalize()?
+                    .starts_with(root.canonicalize()?),
+                "scratch root outside lifecycle directory"
+            );
+            let captured = compatible(&journal, &current, &tuning)?;
+            let input = maintenance_input::reopen(
+                journal.root.clone(),
+                captured.manifest.packs.clone(),
+                captured.refs.clone(),
+            )
+            .await?;
+            let selected = if journal.metadata {
+                captured
+                    .manifest
+                    .packs
+                    .iter()
+                    .map(|p| p.checksum.clone())
+                    .collect()
+            } else {
+                journal.selected.clone()
+            };
+            let plan = pack_segments::resume(
+                input,
+                selected,
+                cfg.refs.clone(),
+                resources,
+                receipts(&journal, cfg)?,
+            )
+            .await?;
+            Ok::<_, anyhow::Error>((journal, captured, plan))
+        }
+        .await;
+        match attempt {
+            Ok(value) => {
+                restored = Some(value);
+                resumed = true;
+            }
+            Err(error) if error.to_string().contains("maintenance attempt is busy") => {
+                return Err(error);
+            }
+            Err(error) => log(format!(
+                "scratch cannot resume ({error:#}); starting a fresh isolated attempt"
+            )),
+        }
+    }
+    let (mut journal, captured, mut physical) = if let Some(value) = restored {
+        value
+    } else {
+        let selected = match &work {
+            Work::Fold(ids) | Work::Classify(ids) => ids.clone(),
+            Work::Freeze(id) => vec![id.clone()],
+            _ => current
+                .manifest
+                .packs
+                .iter()
+                .map(|p| p.checksum.clone())
+                .collect(),
+        };
+        let tier = match work {
+            Work::Fold(_) => 1,
+            Work::Classify(_) | Work::RepairCoverage => 0,
+            _ => 2,
+        };
+        let global = matches!(work, Work::FirstFreeze | Work::Resegment);
+        let pin = handle.pin_local_objects().await;
+        let mut input = maintenance_input::prepare(
+            handle.local().path().to_path_buf(),
+            root,
+            current.manifest.packs.clone(),
+            current.refs.clone(),
+            pin,
+        )
+        .await?;
+        let scratch = input.persist();
+        // Classification uses the whole captured inventory; rewrite selection
+        // is narrowed only after every object has an exact family assignment.
+        let planning_ids = if matches!(work, Work::Classify(_) | Work::RepairCoverage) {
+            current
+                .manifest
+                .packs
+                .iter()
+                .map(|p| p.checksum.clone())
+                .collect()
+        } else {
+            selected.clone()
+        };
+        let physical =
+            pack_segments::plan(input, planning_ids, cfg.refs.clone(), resources).await?;
+        let journal = Journal {
+            root: scratch,
+            manifest: current.manifest.encode_to_vec(),
+            refs: current.refs.encode_to_vec(),
+            policy: cfg.refs.policy_identity(),
+            tuning,
+            selected,
+            tier,
+            global,
+            metadata: matches!(work, Work::Classify(_) | Work::RepairCoverage),
+            receipts: Vec::new(),
+        };
+        save_journal(&path, &journal).await?;
+        abort_after(handle, Phase::Prepared)?;
+        (journal, current, physical)
+    };
+    if journal.metadata {
+        let (returned, classification) = pack_segments::classify(physical).await?;
+        physical = returned;
+        if let Some(mixed) = classification
+            .packs
+            .iter()
+            .find(|p| p.mixed && journal.selected.contains(&p.checksum))
+        {
+            journal.selected = vec![mixed.checksum.clone()];
+            journal.metadata = false;
+            physical = pack_segments::plan(
+                physical.input,
+                journal.selected.clone(),
+                cfg.refs.clone(),
+                resources,
+            )
+            .await?;
+            save_journal(&path, &journal).await?;
+        } else {
+            let outcome =
+                repair_metadata(handle, &captured, classification, lease, cfg, log).await?;
+            drop(physical);
+            let _ = tokio::fs::remove_file(&path).await;
+            // Failed/cancelled blocking workers own their scratch; only the
+            // completed plan above permits successful-path cleanup here.
+            let _ = tokio::fs::remove_dir_all(&journal.root).await;
+            return Ok(Some(outcome));
+        }
+    }
+    for family in 0..physical.families.len() {
+        if physical.families[family].completed {
+            continue;
+        }
+        let group = physical.families[family].group.clone();
+        let kind = physical.families[family].kind;
+        log(format!(
+            "packing family {group} {kind:?} ({}/{})",
+            family + 1,
+            physical.families.len()
+        ));
+        physical = pack_segments::step(physical, family, cfg.packs.clone()).await?;
+        let outputs = physical
+            .outputs
+            .iter()
+            .filter(|o| o.group == group && o.pack.kind == kind as i32)
+            .map(|o| OutputReceipt {
+                descriptor: o.pack.encode_to_vec(),
+                path: o.path.clone(),
+                exceeds_target: o.exceeds_target,
+            })
+            .collect();
+        journal.receipts.push(Receipt {
+            group,
+            kind: kind as i32,
+            outputs,
+        });
+        save_journal(&path, &journal).await?;
+        abort_after(handle, Phase::Step)?;
+    }
+    let finished = pack_segments::finish(physical).await?;
+    let mut outputs: BTreeMap<String, (PackRef, PathBuf)> = BTreeMap::new();
+    for output in &finished.outputs {
+        ensure!(
+            !output.exceeds_target || output.pack.object_count > 0,
+            "empty oversized output"
+        );
+        if output.exceeds_target {
+            log(format!(
+                "pack {} exceeds size target; Git may retain an indivisible oversized object",
+                output.pack.checksum
+            ));
+        }
+        let audience = match output.audience {
+            Some(walgit_config::PackGroupKind::Code) => PackAudience::Code,
+            Some(walgit_config::PackGroupKind::Meta) => PackAudience::Meta,
+            None => PackAudience::Retained,
+        };
+        let entry = outputs
+            .entry(output.pack.checksum.clone())
+            .or_insert_with(|| {
+                let mut pack = output.pack.clone();
+                pack.tier = journal.tier;
+                pack.audience = audience as i32;
+                pack.ref_policy.clone_from(&journal.policy);
+                pack.pack_groups.clear();
+                pack.group_coverages.clear();
+                pack.derived_from = if journal.global {
+                    String::new()
+                } else {
+                    journal.selected.first().cloned().unwrap_or_default()
+                };
+                (pack, output.path.clone())
+            });
+        if audience == PackAudience::Code {
+            entry.0.audience = PackAudience::Code as i32;
+        }
+        if !entry.0.pack_groups.contains(&output.group) {
+            entry.0.pack_groups.push(output.group.clone());
+            entry.0.pack_groups.sort();
+        }
+    }
+    if journal.global
+        && cfg.git.commit_graph
+        && let Some((pack, source)) = outputs
+            .values_mut()
+            .find(|(p, _)| p.kind == PackKind::History as i32)
+    {
+        let oid = gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?;
+        finished
+            .input
+            .repo
+            .write_pack_commit_graph(&oid, cfg.git.commit_graph_changed_paths)
+            .await?;
+        let generated = finished
+            .input
+            .repo
+            .pack_path(&oid)
+            .with_extension("commit-graph");
+        tokio::fs::copy(&generated, source.with_extension("commit-graph")).await?;
+        pack.has_commit_graph = true;
+        tokio::fs::remove_file(generated).await?;
+        let info = finished
+            .input
+            .repo
+            .path()
+            .join("objects/info/commit-graphs");
+        if info.exists() {
+            tokio::fs::remove_dir_all(info).await?;
+        }
+    }
+    let mut classes = Vec::new();
+    for (pack, source) in outputs.values() {
+        lease.lock().await.heartbeat(cfg.packs.lease_ttl).await?;
+        let class = PackClassification::from_pack(pack);
+        if !handle
+            .manifest()
+            .packs
+            .iter()
+            .any(|p| p.checksum == pack.checksum)
+        {
+            handle
+                .publish_prepared_pack(source, pack, class.clone())
+                .await?;
+            log(format!("committed additive pack {}", pack.checksum));
+        }
+        classes.push(pack.clone());
+    }
+    let final_ids = captured
+        .manifest
+        .packs
+        .iter()
+        .filter(|p| !journal.selected.contains(&p.checksum))
+        .map(|p| p.checksum.clone())
+        .chain(outputs.keys().cloned())
+        .collect::<std::collections::BTreeSet<_>>()
+        .into_iter()
+        .map(|id| gix_hash::ObjectId::from_hex(id.as_bytes()))
+        .collect::<Result<Vec<_>, _>>()?;
+    if let Some(commit) = captured
+        .refs
+        .refs
+        .iter()
+        .find(|r| r.name.starts_with("refs/heads/"))
+    {
+        let oid = gix_hash::ObjectId::from_hex(commit.oid.as_bytes())?;
+        handle.local().set_segmented_midx_mode(true);
+        let pin = handle.pin_local_objects().await;
+        handle
+            .local()
+            .write_verified_midx(&final_ids, oid, pin)
+            .await?;
+    }
+    lease.lock().await.heartbeat(cfg.packs.lease_ttl).await?;
+    handle
+        .seal_pack_replacement(&captured, &journal.selected, &classes, &[], lease)
+        .await?;
+    abort_after(handle, Phase::Sealed)?;
+    let outcome = Outcome {
+        packs: outputs.into_keys().collect(),
+        superseded: journal.selected.len(),
+        tier: journal.tier,
+        resumed,
+    };
+    drop(finished);
+    let _ = tokio::fs::remove_file(path).await;
+    let _ = tokio::fs::remove_dir_all(journal.root).await;
+    Ok(Some(outcome))
+}
+
+async fn repair_metadata(
+    handle: &RepoHandle,
+    captured: &PublicationView,
+    classification: pack_segments::Classification,
+    lease: &tokio::sync::Mutex<walgit_store::coord::LeaseGuard>,
+    cfg: &Config,
+    log: Log<'_>,
+) -> anyhow::Result<Outcome> {
+    let snapshot = handle.prepare_coverage_snapshot(captured).await?;
+    let policy = cfg.refs.policy_identity();
+    let mut updates = Vec::new();
+    for member in &classification.packs {
+        if member.mixed {
+            continue;
+        }
+        let audience = match member.audience {
+            Some(walgit_config::PackGroupKind::Code) => PackAudience::Code,
+            Some(walgit_config::PackGroupKind::Meta) => PackAudience::Meta,
+            None => PackAudience::Retained,
+        };
+        updates.push(PackClassification {
+            checksum: member.checksum.clone(),
+            kind: member.kind as i32,
+            audience: audience as i32,
+            ref_policy: policy.clone(),
+            pack_groups: member.groups.clone(),
+            covers_seq: captured.refs.seq,
+            coverage_refs_key: snapshot.key().to_string(),
+            group_coverages: Vec::new(),
+        });
+    }
+    // Metadata refresh can exceed one CAS batch. No partial batch carries a
+    // proof; the final carrier update checks all same-generation members live.
+    for batch in updates.chunks(128) {
+        lease.lock().await.heartbeat(cfg.packs.lease_ttl).await?;
+        handle.reclassify_packs(batch, &[]).await?;
+    }
+    let roots = walgit_git::pack_groups::resolve_groups(
+        &cfg.refs,
+        &walgit_git::RefSnapshotData::from(captured.refs.clone()),
+    )?;
+    let members: BTreeMap<String, Vec<String>> = cfg
+        .refs
+        .packfiles
+        .keys()
+        .map(|group| {
+            (
+                group.clone(),
+                updates
+                    .iter()
+                    .filter(|p| p.pack_groups.contains(group))
+                    .map(|p| p.checksum.clone())
+                    .collect(),
+            )
+        })
+        .collect();
+    let complete = |group: &str| {
+        classification.group_complete.get(group) == Some(&true)
+            && members.get(group).is_some_and(|p| !p.is_empty())
+    };
+    let mut carriers: BTreeMap<String, PackClassification> = BTreeMap::new();
+    for (group, root) in roots {
+        if !complete(&group) || !root.dependencies.iter().all(|d| complete(d)) {
+            continue;
+        }
+        let ids = members.get(&group).context("missing group members")?;
+        let carrier = updates
+            .iter()
+            .find(|p| p.checksum == ids[0])
+            .context("missing coverage carrier")?;
+        carriers
+            .entry(carrier.checksum.clone())
+            .or_insert_with(|| carrier.clone())
+            .group_coverages
+            .push(PackGroupCoverage {
+                group,
+                ref_policy: policy.clone(),
+                covers_seq: captured.refs.seq,
+                packs: ids.clone(),
+                refs_key: snapshot.key().to_string(),
+            });
+    }
+    // Dependency sets must commit together. Bounded policy cardinality keeps
+    // this one batch; exceeding it leaves metadata classified but uncertified.
+    ensure!(
+        carriers.len() <= 128,
+        "coverage has more than 128 carriers; reduce group count"
+    );
+    if !carriers.is_empty() {
+        lease.lock().await.heartbeat(cfg.packs.lease_ttl).await?;
+        handle
+            .reclassify_packs(&carriers.into_values().collect::<Vec<_>>(), &[snapshot])
+            .await?;
+    }
+    log(format!(
+        "classified {} packs and repaired provable group coverage without rewriting pack bytes",
+        updates.len()
+    ));
+    Ok(Outcome {
+        packs: updates.into_iter().map(|p| p.checksum).collect(),
+        superseded: 0,
+        tier: 0,
+        resumed: false,
+    })
+}
diff --git a/crates/walgit-server/src/packfile_uri.rs b/crates/walgit-server/src/packfile_uri.rs
new file mode 100644
index 0000000..943cb1c
--- /dev/null
+++ b/crates/walgit-server/src/packfile_uri.rs
@@ -0,0 +1,487 @@
+//! Immutable pack downloads use ordinary read auth and exact durable membership.
+use axum::http::{HeaderMap, Method};
+use axum::response::Response;
+
+use crate::{AppState, error::ApiError, repo::RepoRoute, smart, static_object};
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+use walgit_git::packfile_uri::{PackfileUri, Selection};
+use walgit_proto::v1::{PackAudience, PackGroupCoverage, PackKind, RefSnapshot};
+use walgit_wal::{FetchView, RepoHandle};
+
+/// Called only after native-engine dispatch. Protected stock clients remain on
+/// dynamic transfer until an authenticated distributable client is qualified.
+pub async fn select(
+    handle: &RepoHandle,
+    request: &walgit_git::UploadPackRequest,
+    base_url: &str,
+) -> Option<Selection> {
+    if !request.done
+        || request.wants.is_empty()
+        || !request.want_refs.is_empty()
+        || !request.shallow.is_empty()
+        || request.deepen.is_some()
+        || request.deepen_since.is_some()
+        || !request.deepen_not.is_empty()
+        || request.filter.as_deref().is_some_and(|f| f != "blob:none")
+    {
+        return None;
+    }
+    let protocol = base_url.split_once("://")?.0;
+    if !request
+        .packfile_uris_protocols
+        .iter()
+        .any(|p| p == protocol)
+    {
+        return None;
+    }
+    let view = handle.fetch_view().await.ok()?;
+    let policy = view.config.refs.policy_identity();
+    let mut candidates: Vec<_> = view
+        .manifest
+        .packs
+        .iter()
+        .flat_map(|p| &p.group_coverages)
+        .filter(|c| {
+            c.ref_policy == policy
+                && c.covers_seq <= view.manifest.head_seq
+                && !c.refs_key.is_empty()
+        })
+        .map(|c| (c.covers_seq, c.refs_key.clone()))
+        .collect::<BTreeSet<_>>()
+        .into_iter()
+        .collect();
+    candidates.reverse();
+    // Shared request budget, not three attempts per group or dependency.
+    for (seq, key) in candidates.into_iter().take(3) {
+        let snapshot = match handle.read_coverage_snapshot(&view, &key, seq).await {
+            Ok(snapshot) => snapshot,
+            Err(error) => {
+                tracing::warn!(repo = %handle.id(), %error, "coverage snapshot unavailable; dynamic fetch remains available");
+                continue;
+            }
+        };
+        if let Some(mut selection) = select_snapshot(&view, request, &snapshot, &key, base_url) {
+            if request.packfile_indexes {
+                for pack in &mut selection.packs {
+                    pack.index = local_index_uri(handle, pack, base_url).await;
+                }
+            }
+            return Some(selection);
+        }
+    }
+    None
+}
+
+async fn local_index_uri(
+    handle: &RepoHandle,
+    pack: &PackfileUri,
+    base: &str,
+) -> Option<walgit_git::packfile_uri::IndexUri> {
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
+    let mut file = tokio::fs::File::open(
+        handle
+            .local()
+            .pack_path(&pack.checksum)
+            .with_extension("idx"),
+    )
+    .await
+    .ok()?;
+    let length = pack.checksum.kind().len_in_bytes();
+    file.seek(std::io::SeekFrom::End(-i64::try_from(length).ok()?))
+        .await
+        .ok()?;
+    let mut trailer = vec![0; length];
+    file.read_exact(&mut trailer).await.ok()?;
+    Some(walgit_git::packfile_uri::IndexUri {
+        checksum: gix_hash::ObjectId::from_hex(hex::encode(trailer).as_bytes()).ok()?,
+        url: format!(
+            "{}/packfiles/{}.idx",
+            base.trim_end_matches('/'),
+            pack.checksum
+        ),
+    })
+}
+
+fn select_snapshot(
+    view: &FetchView,
+    request: &walgit_git::UploadPackRequest,
+    snapshot: &RefSnapshot,
+    key: &str,
+    base_url: &str,
+) -> Option<Selection> {
+    let cfg = &view.config;
+    let policy = cfg.refs.policy_identity();
+    let live: BTreeMap<_, _> = view
+        .manifest
+        .packs
+        .iter()
+        .map(|p| (p.checksum.as_str(), p))
+        .collect();
+    let mut proofs: BTreeMap<&str, &PackGroupCoverage> = BTreeMap::new();
+    for carrier in &view.manifest.packs {
+        for proof in &carrier.group_coverages {
+            if proof.refs_key != key
+                || proof.covers_seq != snapshot.seq
+                || proof.ref_policy != policy
+            {
+                continue;
+            }
+            if !proof.packs.contains(&carrier.checksum)
+                || !carrier.pack_groups.contains(&proof.group)
+            {
+                return None;
+            }
+            if let Some(previous) = proofs.insert(&proof.group, proof)
+                && previous != proof
+            {
+                return None;
+            }
+        }
+    }
+    let wants: HashSet<_> = request.wants.iter().map(ToString::to_string).collect();
+    let mut covered_wants = HashSet::new();
+    let mut groups = BTreeSet::new();
+    for reference in &snapshot.refs {
+        let Some(current) = view.refs.get(&reference.name) else {
+            continue;
+        };
+        if !wants.contains(&current) {
+            continue;
+        }
+        if let Some((name, _)) = cfg.refs.packfiles.iter().find(|(name, group)| {
+            group.kind == walgit_config::PackGroupKind::Code
+                && group.matches_ref(&reference.name, view.refs.head_target())
+                && proofs.contains_key(name.as_str())
+        }) {
+            covered_wants.insert(current);
+            groups.insert(name.as_str());
+        }
+    }
+    if covered_wants != wants {
+        return None;
+    }
+    let mut pending: Vec<_> = groups.iter().copied().collect();
+    while let Some(name) = pending.pop() {
+        let group = cfg.refs.packfiles.get(name)?;
+        if group.kind != walgit_config::PackGroupKind::Code {
+            return None;
+        }
+        for dependency in &group.subtract {
+            if groups.insert(dependency.as_str()) {
+                pending.push(dependency.as_str());
+            }
+        }
+    }
+    let mut selected = BTreeSet::new();
+    for group in &groups {
+        let proof = proofs.get(group)?;
+        let members: BTreeSet<_> = proof.packs.iter().collect();
+        if members.is_empty() || members.len() != proof.packs.len() {
+            return None;
+        }
+        for id in &proof.packs {
+            let pack = live.get(id.as_str())?;
+            if pack.ref_policy != policy
+                || pack.covers_seq != snapshot.seq
+                || pack.coverage_refs_key != key
+                || !pack.pack_groups.iter().any(|g| g == group)
+                || pack.audience != PackAudience::Code as i32
+            {
+                return None;
+            }
+            let kind = PackKind::try_from(pack.kind).ok()?;
+            if request.filter.as_deref() == Some("blob:none") {
+                match kind {
+                    PackKind::Blobs => continue,
+                    PackKind::History => {}
+                    PackKind::Objects => return None,
+                }
+            }
+            selected.insert(id.as_str());
+        }
+    }
+    if selected.is_empty()
+        || selected.len() > cfg.packfile_uri.max_uris_per_fetch
+        || !selected.iter().any(|id| {
+            live.get(id)
+                .is_some_and(|p| p.pack_size >= cfg.packfile_uri.uri_min_bytes.as_u64())
+        })
+    {
+        return None;
+    }
+    // Only commits under branch refs become synthetic haves. Tags and other
+    // object kinds can be delivered statically but do not broaden the cut.
+    let mut roots = BTreeSet::new();
+    for reference in &snapshot.refs {
+        if reference.name.starts_with("refs/heads/")
+            && groups.iter().any(|name| {
+                cfg.refs
+                    .packfiles
+                    .get(*name)
+                    .is_some_and(|g| g.matches_ref(&reference.name, &snapshot.head_target))
+            })
+        {
+            roots.insert(gix_hash::ObjectId::from_hex(reference.oid.as_bytes()).ok()?);
+        }
+    }
+    if roots.is_empty() || roots.iter().all(|oid| request.haves.contains(oid)) {
+        return None;
+    }
+    let mut ordered: Vec<_> = selected.into_iter().collect();
+    ordered.sort_by_key(|id| {
+        (
+            std::cmp::Reverse(live.get(id).map_or(0, |p| p.pack_size)),
+            *id,
+        )
+    });
+    let packs = ordered
+        .into_iter()
+        .map(|id| {
+            Some(PackfileUri {
+                checksum: gix_hash::ObjectId::from_hex(id.as_bytes()).ok()?,
+                url: format!("{}/packfiles/{id}.pack", base_url.trim_end_matches('/')),
+                index: None,
+            })
+        })
+        .collect::<Option<Vec<_>>>()?;
+    Some(Selection {
+        packs,
+        roots: roots.into_iter().collect(),
+    })
+}
+
+pub async fn get(
+    state: &AppState,
+    route: &RepoRoute,
+    method: &Method,
+    headers: &HeaderMap,
+    peer: Option<std::net::SocketAddr>,
+) -> Result<Response, ApiError> {
+    state
+        .auth
+        .require_read(headers)
+        .await
+        .map_err(smart::auth_err)?;
+    if !state
+        .cfg
+        .placement
+        .serves(route.id.owner(), route.id.name())
+    {
+        return Err(ApiError::ServiceUnavailable(format!(
+            "{} is not served by this host; retry shortly",
+            route.id
+        )));
+    }
+    let name = route
+        .subpath
+        .strip_prefix("packfiles/")
+        .ok_or_else(|| ApiError::NotFound("packfile".into()))?;
+    let (checksum, extension) = name
+        .rsplit_once('.')
+        .ok_or_else(|| ApiError::NotFound("packfile".into()))?;
+    if !matches!(extension, "pack" | "idx")
+        || !matches!(checksum.len(), 40 | 64)
+        || !checksum
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+    {
+        return Err(ApiError::NotFound("packfile".into()));
+    }
+    let handle = smart::open_repo(state, &route.id, false).await?;
+    if checksum.len() != handle.local().object_format().kind().len_in_hex()
+        || !handle
+            .serves_pack_fresh(checksum)
+            .await
+            .map_err(smart::wal_err)?
+    {
+        return Err(ApiError::NotFound(
+            "packfile is not in the live or retired inventory".into(),
+        ));
+    }
+    // Auth and manifest admission precede conditional responses, cache admission,
+    // Range handling and optional loopback edge offload alike.
+    static_object::serve(
+        handle.store(),
+        &format!("wal/{checksum}.{extension}"),
+        method,
+        headers,
+        static_object::ServeOptions {
+            cache_control: (state.cfg.server.auth.mode != walgit_config::AuthMode::None
+                && !state.cfg.server.auth.anonymous_read)
+                .then_some("private, max-age=31536000, immutable"),
+            accel: state.cfg.server.accel_redirect,
+            peer,
+            ..Default::default()
+        },
+    )
+    .await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Arc;
+    use walgit_config::{Config, PackGroupConfig, PackGroupKind};
+    use walgit_proto::v1::{Manifest, PackRef, Ref};
+
+    fn fixture() -> (FetchView, walgit_git::UploadPackRequest, RefSnapshot) {
+        let mut cfg = Config::default();
+        cfg.refs.packfiles.remove("code");
+        for (name, reference, subtract) in [
+            ("base", "refs/heads/main", vec![]),
+            ("topic", "refs/heads/topic", vec!["base".into()]),
+        ] {
+            cfg.refs.packfiles.insert(
+                name.into(),
+                PackGroupConfig {
+                    kind: PackGroupKind::Code,
+                    include: vec![reference.into()],
+                    subtract,
+                },
+            );
+        }
+        cfg.packfile_uri.uri_min_bytes = bytesize::ByteSize::b(100);
+        let policy = cfg.refs.policy_identity();
+        let snapshot = RefSnapshot {
+            seq: 10,
+            object_format: "sha1".into(),
+            head_target: "refs/heads/main".into(),
+            refs: vec![
+                Ref {
+                    name: "refs/heads/main".into(),
+                    oid: format!("{:040x}", 1),
+                    ..Default::default()
+                },
+                Ref {
+                    name: "refs/heads/topic".into(),
+                    oid: format!("{:040x}", 2),
+                    ..Default::default()
+                },
+            ],
+            ..Default::default()
+        };
+        let mut manifest = Manifest {
+            head_seq: 11,
+            ..Default::default()
+        };
+        for (group, start) in [("base", 10), ("topic", 20)] {
+            let ids = [format!("{start:040x}"), format!("{:040x}", start + 1)];
+            for (n, id) in ids.iter().enumerate() {
+                manifest.packs.push(PackRef {
+                    checksum: id.clone(),
+                    pack_size: if start == 20 && n == 1 { 100 } else { 1 },
+                    kind: if n == 0 {
+                        PackKind::History
+                    } else {
+                        PackKind::Blobs
+                    } as i32,
+                    audience: PackAudience::Code as i32,
+                    pack_groups: vec![group.into()],
+                    covers_seq: 10,
+                    coverage_refs_key: "captured-key".into(),
+                    ref_policy: policy.clone(),
+                    group_coverages: if n == 0 {
+                        vec![PackGroupCoverage {
+                            group: group.into(),
+                            covers_seq: 10,
+                            refs_key: "captured-key".into(),
+                            ref_policy: policy.clone(),
+                            packs: ids.to_vec(),
+                        }]
+                    } else {
+                        vec![]
+                    },
+                    ..Default::default()
+                });
+            }
+        }
+        let mut refs = walgit_git::RefView::new(Arc::new(snapshot.clone().into()));
+        let new_tip = gix_hash::ObjectId::from_hex(format!("{:040x}", 3).as_bytes()).unwrap();
+        refs.set("refs/heads/topic", new_tip.to_string());
+        (
+            FetchView {
+                manifest: Arc::new(manifest),
+                refs,
+                config: Arc::new(cfg),
+            },
+            walgit_git::UploadPackRequest {
+                wants: vec![new_tip],
+                done: true,
+                ..Default::default()
+            },
+            snapshot,
+        )
+    }
+
+    #[test]
+    fn complete_dependencies_include_small_companions_and_reject_scope_mutations() {
+        let (view, request, snapshot) = fixture();
+        let chosen = select_snapshot(
+            &view,
+            &request,
+            &snapshot,
+            "captured-key",
+            "https://example.invalid/o/r",
+        )
+        .unwrap();
+        assert_eq!(chosen.packs.len(), 4);
+        assert_eq!(chosen.roots.len(), 2);
+        for mutation in 0..6 {
+            let (mut view, request, snapshot) = fixture();
+            let manifest = Arc::make_mut(&mut view.manifest);
+            match mutation {
+                0 => {
+                    manifest.packs.remove(1);
+                } // retired dependency member
+                1 => manifest.packs[0].group_coverages.clear(), // missing dependency proof
+                2 => manifest.packs[1].covers_seq = 9,          // mixed generation
+                3 => manifest.packs[1].pack_groups = vec!["meta".into()],
+                4 => manifest.packs[1].ref_policy = "old-policy".into(),
+                5 => {
+                    Arc::make_mut(&mut view.config)
+                        .packfile_uri
+                        .max_uris_per_fetch = 3;
+                }
+                _ => unreachable!(),
+            }
+            assert!(
+                select_snapshot(
+                    &view,
+                    &request,
+                    &snapshot,
+                    "captured-key",
+                    "https://example.invalid/o/r"
+                )
+                .is_none(),
+                "mutation {mutation}"
+            );
+        }
+    }
+
+    #[test]
+    fn blobless_delivery_uses_history_and_never_treats_objects_packs_as_history() {
+        let (mut view, mut request, snapshot) = fixture();
+        request.filter = Some("blob:none".into());
+        Arc::make_mut(&mut view.config).packfile_uri.uri_min_bytes = bytesize::ByteSize::b(1);
+        let selected = select_snapshot(
+            &view,
+            &request,
+            &snapshot,
+            "captured-key",
+            "https://example.invalid/o/r",
+        )
+        .unwrap();
+        assert_eq!(selected.packs.len(), 2);
+        Arc::make_mut(&mut view.manifest).packs[0].kind = PackKind::Objects as i32;
+        assert!(
+            select_snapshot(
+                &view,
+                &request,
+                &snapshot,
+                "captured-key",
+                "https://example.invalid/o/r"
+            )
+            .is_none()
+        );
+    }
+}
diff --git a/crates/walgit-server/src/rebuild.rs b/crates/walgit-server/src/rebuild.rs
deleted file mode 100644
index 8247234..0000000
--- a/crates/walgit-server/src/rebuild.rs
+++ /dev/null
@@ -1,434 +0,0 @@
-//! Resumable base rebuild (`docs/BUNDLE_URI_DESIGN.md` §5a): `git repack -adb` of a big
-//! repository is 16–30 min of one core plus a 10-min history pack; a deploy mid-way (D31
-//! interrupts units at once) used to throw that away and — worse — the repack rewrote the
-//! *serving copy's* `objects/pack` in place.
-//!
-//! Now the rebuild works in a **scratch copy** under `<cache.dir>/_rebuild/<owner>/<repo>.git`
-//! (on the SSD host `/data` is a bind mount that outlives the container; the copy is
-//! `copy_file_range`, which XFS turns into a reflink — seconds, no bytes duplicated until
-//! written), records a **phase marker** next to it after each completed phase, and the next
-//! unit **resumes iff the manifest's `head_seq` is unchanged** since the rebuild started
-//! (otherwise the scratch is discarded: a push landed, the pack would miss its objects).
-//! Finished packs are hard-linked into the serving copy only at publish time — the serving
-//! copy is never rewritten — and publish is idempotent (an already-live checksum is not
-//! re-published; the supersede set is the packs that existed when the rebuild started).
-//! D31 is unchanged: SIGTERM kills `git repack`; git writes packs by temp name + rename, so a
-//! half-written pack never looks final; the marker's phase is whatever completed.
-
-use std::path::{Path, PathBuf};
-use std::time::Instant;
-
-use anyhow::{Context, bail};
-use walgit_config::Config;
-use walgit_git::{LocalRepo, RepackMode, RepackOptions};
-use walgit_wal::RepoHandle;
-
-use crate::ops::Log;
-
-/// Phases in order; the marker names the last one that completed.
-#[derive(
-    Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, serde::Serialize, serde::Deserialize,
-)]
-#[serde(rename_all = "kebab-case")]
-pub enum Phase {
-    Copied,
-    Repacked,
-    HistoryPack,
-    CommitGraph,
-}
-
-#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
-pub struct Marker {
-    /// `manifest.head_seq` when the scratch copy was taken: resume only while it is unchanged.
-    pub started_head_seq: u64,
-    pub phase: Phase,
-    /// The base pack(s) the repack produced (hex; one unless git split the pack).
-    #[serde(default)]
-    pub new_packs: Vec<String>,
-    /// The D18 history pack derived from the first base (hex).
-    #[serde(default)]
-    pub history: Option<String>,
-    /// The pack carrying the commit-graph layer (hex).
-    #[serde(default)]
-    pub commit_graph: Option<String>,
-}
-
-/// Test hook (sim): abort the rebuild of `repo` right after `phase`'s marker was written — a
-/// SIGTERM between phases. Per repository so parallel tests do not see each other's hook.
-pub static TEST_ABORT_AFTER: parking_lot::Mutex<Option<(String, Phase)>> =
-    parking_lot::Mutex::new(None);
-
-fn abort_after(repo: &walgit_git::RepoId, phase: Phase) -> anyhow::Result<()> {
-    let hook = TEST_ABORT_AFTER.lock().clone();
-    if let Some((r, p)) = hook
-        && r == repo.to_string()
-        && p == phase
-    {
-        bail!("rebuild aborted by test hook after phase {phase:?}");
-    }
-    Ok(())
-}
-
-pub struct RebuildOutcome {
-    /// Checksums published (base(s), then the history pack).
-    pub packs: Vec<String>,
-    pub superseded: usize,
-    /// True when this unit continued an earlier, interrupted rebuild.
-    pub resumed: bool,
-}
-
-fn scratch_root(cfg: &Config) -> PathBuf {
-    cfg.cache.dir.join("_rebuild")
-}
-
-fn marker_path(cfg: &Config, id: &walgit_git::RepoId) -> PathBuf {
-    scratch_root(cfg)
-        .join(id.owner())
-        .join(format!("{}.json", id.name()))
-}
-
-fn read_marker(path: &Path) -> Option<Marker> {
-    let bytes = std::fs::read(path).ok()?;
-    serde_json::from_slice(&bytes).ok()
-}
-
-fn write_marker(path: &Path, m: &Marker) -> anyhow::Result<()> {
-    std::fs::create_dir_all(path.parent().unwrap())?;
-    let tmp = path.with_extension("json.tmp");
-    std::fs::write(&tmp, serde_json::to_vec_pretty(m)?)?;
-    std::fs::rename(&tmp, path)?;
-    Ok(())
-}
-
-/// Recursive copy. `std::fs::copy` uses `copy_file_range` on Linux, which XFS/btrfs satisfy
-/// with a reflink when source and destination share a filesystem (seconds for 40 GB, no
-/// bytes duplicated until written) and which degrades to a plain copy elsewhere.
-fn copy_tree(src: &Path, dst: &Path) -> std::io::Result<u64> {
-    std::fs::create_dir_all(dst)?;
-    let mut bytes = 0u64;
-    for ent in std::fs::read_dir(src)? {
-        let ent = ent?;
-        let from = ent.path();
-        let to = dst.join(ent.file_name());
-        let ft = ent.file_type()?;
-        if ft.is_dir() {
-            bytes += copy_tree(&from, &to)?;
-        } else if ft.is_file() {
-            bytes += std::fs::copy(&from, &to)?;
-        } else if ft.is_symlink() {
-            // A mount-linked base (`pack-<sha>.pack` → store mount) is never rebuilt here:
-            // the rebuild needs real files (compact_repo syncs Full first).
-            let target = std::fs::read_link(&from)?;
-            std::os::unix::fs::symlink(target, &to)?;
-        }
-    }
-    Ok(bytes)
-}
-
-// statvfs's block fields are u32 on macOS and u64 on Linux, so `as u64` is the one spelling
-// that is lossless on both; `From` would be a useless conversion on Linux.
-#[allow(clippy::cast_lossless)]
-fn disk_avail(path: &Path) -> Option<u64> {
-    use std::ffi::CString;
-    use std::os::unix::ffi::OsStrExt;
-    let c = CString::new(path.as_os_str().as_bytes()).ok()?;
-    // SAFETY: statvfs is a C integer struct; all-zero is a valid initialized value.
-    #[allow(unsafe_code)]
-    let mut st: libc::statvfs = unsafe { std::mem::zeroed() };
-    // SAFETY: c is NUL-terminated and live; st is aligned writable storage for statvfs.
-    #[allow(unsafe_code)]
-    let result = unsafe { libc::statvfs(c.as_ptr(), &raw mut st) };
-    if result != 0 {
-        return None;
-    }
-    Some(st.f_bavail as u64 * st.f_frsize as u64)
-}
-
-/// Hard-link (or copy) every side-file of `pack` from `from` into `into`'s pack dir; existing
-/// files are left alone (a resumed install).
-fn install_pack(
-    from: &LocalRepo,
-    into: &LocalRepo,
-    pack: &gix_hash::ObjectId,
-) -> anyhow::Result<()> {
-    let src = from.pack_path(pack);
-    let dst = into.pack_path(pack);
-    std::fs::create_dir_all(dst.parent().unwrap())?;
-    for ext in ["pack", "idx", "rev", "bitmap", "commit-graph", "history"] {
-        let s = src.with_extension(ext);
-        if !s.exists() {
-            continue;
-        }
-        let d = dst.with_extension(ext);
-        if d.exists() {
-            continue;
-        }
-        if std::fs::hard_link(&s, &d).is_err() {
-            std::fs::copy(&s, &d).with_context(|| format!("installing {}", d.display()))?;
-        }
-    }
-    Ok(())
-}
-
-/// Rebuild the tier-2 base of `handle`'s repository in a scratch copy, resuming an interrupted
-/// rebuild when the WAL head has not moved, then install + publish: the new base (superseding
-/// every live pack that existed when the rebuild started), the D18 history pack, the
-/// commit-graph layer. The caller holds the compaction lease and has synced Full.
-pub async fn rebuild_base(
-    handle: &RepoHandle,
-    cfg: &Config,
-    log: Log<'_>,
-) -> anyhow::Result<RebuildOutcome> {
-    let id = handle.id().clone();
-    let root = scratch_root(cfg);
-    let scratch_dir = id.local_dir(&root);
-    let marker_path = marker_path(cfg, &id);
-    let manifest = handle.manifest();
-    let head = manifest.head_seq;
-
-    // 1. Resume or start over.
-    let mut marker = match read_marker(&marker_path) {
-        Some(m) if m.started_head_seq == head && scratch_dir.join("objects").is_dir() => {
-            log(format!(
-                "resuming base rebuild started at head_seq {head}: phase {:?} done",
-                m.phase
-            ));
-            m
-        }
-        Some(m) => {
-            log(format!(
-                "discarding interrupted base rebuild (started at head_seq {}, head is now {head}, phase {:?}): starting over",
-                m.started_head_seq, m.phase
-            ));
-            let _ = std::fs::remove_dir_all(&scratch_dir);
-            let _ = std::fs::remove_file(&marker_path);
-            start_scratch(handle, cfg, &manifest, &scratch_dir, &marker_path, log)?
-        }
-        None => {
-            let _ = std::fs::remove_dir_all(&scratch_dir);
-            start_scratch(handle, cfg, &manifest, &scratch_dir, &marker_path, log)?
-        }
-    };
-    let resumed = marker.phase > Phase::Copied;
-    let scratch =
-        LocalRepo::open(&root, &id)?.context("scratch copy did not open as a repository")?;
-
-    // 2. Repack (full, bitmap) in the scratch copy.
-    if marker.phase < Phase::Repacked {
-        let t = Instant::now();
-        let result = scratch
-            .repack(RepackOptions {
-                mode: RepackMode::Full,
-                write_bitmap: true,
-                write_midx: false,
-                keep: Vec::new(),
-            })
-            .await?;
-        let mut new: Vec<String> = result
-            .new_packs
-            .iter()
-            .map(|p| p.checksum.to_hex().to_string())
-            .collect();
-        if new.is_empty() {
-            // Already a single pack: `repack -adb` only added the bitmap. The base is that pack.
-            let mut packs = scratch.packs()?;
-            packs.sort_by_key(|p| std::cmp::Reverse(p.pack_size));
-            if let Some(p) = packs
-                .iter()
-                .find(|p| p.has_bitmap && p.history_of.is_none())
-            {
-                new.push(p.checksum.to_hex().to_string());
-            }
-        }
-        log(format!(
-            "repack done in {:.1}s: {} new pack(s), {} removed in the scratch copy",
-            t.elapsed().as_secs_f64(),
-            result.new_packs.len(),
-            result.removed.len()
-        ));
-        if new.is_empty() {
-            bail!("full repack produced no base pack");
-        }
-        marker.new_packs = new;
-        marker.phase = Phase::Repacked;
-        write_marker(&marker_path, &marker)?;
-        abort_after(&id, Phase::Repacked)?;
-    }
-    let bases: Vec<gix_hash::ObjectId> = marker
-        .new_packs
-        .iter()
-        .filter_map(|h| gix_hash::ObjectId::from_hex(h.as_bytes()).ok())
-        .collect();
-
-    // 3. History pack (D18) of the first base.
-    if marker.phase < Phase::HistoryPack {
-        if cfg.git.history_pack
-            && let Some(base) = bases.first()
-        {
-            let t = Instant::now();
-            match scratch.write_history_pack(base).await {
-                Ok(hp) => {
-                    log(format!(
-                        "history pack {} for base {base}: {} bytes, {} objects in {:.1}s",
-                        hp.checksum,
-                        hp.pack_size,
-                        hp.object_count,
-                        t.elapsed().as_secs_f64()
-                    ));
-                    marker.history = Some(hp.checksum.to_hex().to_string());
-                }
-                Err(e) => log(format!("history pack failed (continuing without): {e}")),
-            }
-        }
-        marker.phase = Phase::HistoryPack;
-        write_marker(&marker_path, &marker)?;
-        abort_after(&id, Phase::HistoryPack)?;
-    }
-
-    // 4. One commit-graph layer on the biggest base.
-    if marker.phase < Phase::CommitGraph {
-        if cfg.git.commit_graph {
-            let packs = scratch.packs()?;
-            let biggest = bases
-                .iter()
-                .filter_map(|b| packs.iter().find(|p| &p.checksum == b))
-                .max_by_key(|p| p.pack_size)
-                .map(|p| p.checksum);
-            if let Some(b) = biggest {
-                let t = Instant::now();
-                match scratch
-                    .write_pack_commit_graph(&b, cfg.git.commit_graph_changed_paths)
-                    .await
-                {
-                    Ok(bytes) => {
-                        log(format!(
-                            "commit-graph layer on pack {b}: {bytes} bytes in {:.1}s",
-                            t.elapsed().as_secs_f64()
-                        ));
-                        marker.commit_graph = Some(b.to_hex().to_string());
-                    }
-                    Err(e) => log(format!(
-                        "commit-graph write failed (continuing without): {e}"
-                    )),
-                }
-            }
-        }
-        marker.phase = Phase::CommitGraph;
-        write_marker(&marker_path, &marker)?;
-        abort_after(&id, Phase::CommitGraph)?;
-    }
-
-    // 5. Install into the serving copy (links, never a rewrite) and publish. The supersede set is
-    //    every pack that was live when the rebuild started (seq ≤ started_head_seq) and is not one
-    //    of the new ones; pushes that landed since keep their packs.
-    let mut to_install = bases.clone();
-    if let Some(h) = marker
-        .history
-        .as_deref()
-        .and_then(|h| gix_hash::ObjectId::from_hex(h.as_bytes()).ok())
-    {
-        to_install.push(h);
-    }
-    for p in &to_install {
-        install_pack(&scratch, handle.local(), p)?;
-    }
-    handle.local().refresh_async().await?;
-    let local_packs = handle.local().packs()?;
-    let manifest = handle.manifest();
-    let new_set: std::collections::HashSet<String> =
-        to_install.iter().map(|c| c.to_hex().to_string()).collect();
-    let supersedes: Vec<gix_hash::ObjectId> = manifest
-        .packs
-        .iter()
-        .filter(|p| p.seq <= marker.started_head_seq && !new_set.contains(&p.checksum))
-        .filter_map(|p| gix_hash::ObjectId::from_hex(p.checksum.as_bytes()).ok())
-        .collect();
-    let superseded = supersedes.len();
-    let mut supersedes_left = Some(supersedes);
-    let mut published = Vec::new();
-    for c in &to_install {
-        let hex = c.to_hex().to_string();
-        let Some(info) = local_packs.iter().find(|p| &p.checksum == c).cloned() else {
-            bail!("pack {hex} not visible in the serving copy after install");
-        };
-        let already = manifest.packs.iter().find(|p| p.checksum == hex);
-        // Already live at the right tier and not the carrier of the supersede set: nothing to publish.
-        if let Some(p) = already
-            && p.tier == 2
-            && (p.has_bitmap || info.history_of.is_some())
-            && supersedes_left.as_ref().is_none_or(std::vec::Vec::is_empty)
-        {
-            log(format!(
-                "pack {hex} is already live as tier 2: not re-published"
-            ));
-            published.push(hex);
-            continue;
-        }
-        let sup = supersedes_left.take().unwrap_or_default();
-        let seq = handle.publish_compact(info, sup, 2).await?;
-        log(format!(
-            "published pack {hex} as seq {seq}{}",
-            if already.is_some() {
-                " (promotion)"
-            } else {
-                ""
-            }
-        ));
-        published.push(hex);
-    }
-
-    // 6. Done: the scratch and its marker go.
-    let _ = std::fs::remove_dir_all(&scratch_dir);
-    let _ = std::fs::remove_file(&marker_path);
-    Ok(RebuildOutcome {
-        packs: published,
-        superseded,
-        resumed,
-    })
-}
-
-fn start_scratch(
-    handle: &RepoHandle,
-    cfg: &Config,
-    manifest: &walgit_proto::v1::Manifest,
-    scratch_dir: &Path,
-    marker_path: &Path,
-    log: Log<'_>,
-) -> anyhow::Result<Marker> {
-    // Headroom: the repack writes a new pack about the size of the live set (a reflink copy
-    // costs nothing until then). Fail loudly rather than fill the disk the serving copy lives on.
-    let need: u64 = manifest
-        .packs
-        .iter()
-        .map(|p| p.pack_size + p.idx_size)
-        .sum();
-    if let Some(avail) = disk_avail(&cfg.cache.dir)
-        && avail < need
-    {
-        bail!(
-            "not enough disk for a base rebuild under {}: {} available, the pack set is {} (the repack writes a pack that size)",
-            cfg.cache.dir.display(),
-            walgit_wal::remote::human_bytes(avail),
-            walgit_wal::remote::human_bytes(need)
-        );
-    }
-    let t = Instant::now();
-    let bytes = copy_tree(handle.local().path(), scratch_dir)
-        .context("copying the serving copy to the scratch dir")?;
-    log(format!(
-        "scratch copy of the serving copy at {} ({} in {:.1}s; reflinked where the filesystem allows)",
-        scratch_dir.display(),
-        walgit_wal::remote::human_bytes(bytes),
-        t.elapsed().as_secs_f64()
-    ));
-    let m = Marker {
-        started_head_seq: manifest.head_seq,
-        phase: Phase::Copied,
-        new_packs: Vec::new(),
-        history: None,
-        commit_graph: None,
-    };
-    write_marker(marker_path, &m)?;
-    abort_after(handle.id(), Phase::Copied)?;
-    Ok(m)
-}
diff --git a/crates/walgit-server/src/settings.rs b/crates/walgit-server/src/settings.rs
index c25b98d..0c6da1e 100644
--- a/crates/walgit-server/src/settings.rs
+++ b/crates/walgit-server/src/settings.rs
@@ -78,7 +78,8 @@ pub async fn http_effective(
         .await
         .map_err(|e| ApiError::Internal(e.to_string()))?;
     let text = h
-        .effective_config()
+        .validated_effective_config()
+        .map_err(|e| ApiError::Internal(e.to_string()))?
         .public_settings_toml()
         .map_err(|e| ApiError::Internal(e.to_string()))?;
     Ok((
@@ -218,8 +219,7 @@ fn toml_json(v: &toml::Value) -> serde_json::Value {
     serde_json::to_value(v).unwrap_or(serde_json::Value::Null)
 }
 
-/// Everything the Settings tab needs in one answer: the strategies (with the
-/// next fire time and a human preview), placement (host-level, read-only),
+/// Everything the Settings tab needs in one answer: placement (host-level, read-only),
 /// the effective config as a flat `key → {value, source}` map restricted to
 /// the settings sections, the current settings document and the history.
 pub async fn http_describe(
@@ -233,7 +233,9 @@ pub async fn http_describe(
         .await
         .map_err(|e| ApiError::Internal(e.to_string()))?;
     let settings = h.settings();
-    let effective = h.effective_config();
+    let effective = h
+        .validated_effective_config()
+        .map_err(|e| ApiError::Internal(e.to_string()))?;
     Ok((
         StatusCode::OK,
         [(axum::http::header::CACHE_CONTROL, "no-store")],
@@ -248,28 +250,6 @@ fn describe_json(
     effective: &walgit_config::Config,
     settings: Option<&walgit_proto::v1::RepoSettings>,
 ) -> Result<serde_json::Value, ApiError> {
-    let now = std::time::SystemTime::now();
-    let strategies: Vec<serde_json::Value> = effective
-        .bundles
-        .strategy
-        .iter()
-        .map(|s| {
-            let (next, human) = match walgit_bundle::schedule::parse_schedule(&s.schedule) {
-                Ok(sch) => (
-                    walgit_bundle::schedule::next_fire_after(&sch, now).map(|t| chrono::DateTime::<chrono::Utc>::from(t).to_rfc3339()),
-                    human_schedule(&s.schedule),
-                ),
-                Err(e) => (None, format!("invalid: {e}")),
-            };
-            json!({
-                "name": s.name, "kind": format!("{:?}", s.kind).to_lowercase(), "base": s.base, "schedule": s.schedule,
-                "schedule_human": human, "next": next, "keep": s.keep, "backfill_max": s.backfill_max,
-                "min_commits": s.min_commits.unwrap_or(effective.bundles.min_commits),
-                "refs": walgit_bundle::slots::default_refs(&effective.bundles, s),
-                "chain": s.chain, "filter": s.filter,
-            })
-        })
-        .collect();
     // Sources: every key of the settings sections; a key is "setting" when the
     // repo document sets it (rev/author), else "host" (walgit.toml ⊕ env).
     let host_doc: toml::Table =
@@ -299,19 +279,11 @@ fn describe_json(
             if k.ends_with("token_env") {
                 continue;
             }
-            // Array-of-tables (strategies) count as set when the document has the array.
-            let top = k.split('.').take(2).collect::<Vec<_>>().join(".");
-            let is_set = set_keys.contains(&k)
-                || set_keys
-                    .iter()
-                    .any(|s| s.starts_with(&format!("{top}.")) || s == &top)
-                    && k.starts_with(&top)
-                    && k.contains("strategy");
             fields.push(json!({
                 "key": k,
                 "value": toml_json(&v),
                 "host_value": host_map.get(&k).map(toml_json),
-                "source": if is_set { "setting" } else { "host" },
+                "source": if set_keys.contains(&k) { "setting" } else { "host" },
             }));
         }
     }
@@ -320,14 +292,12 @@ fn describe_json(
         "repo": h.id().to_string(),
         "settings": settings.map(|s| json!({"revision": s.revision, "author": s.author, "message": s.message, "updated_at": ts(s.updated_at.as_ref()), "toml": s.toml})).unwrap_or(json!({"revision": 0, "toml": ""})),
         "sections": walgit_config::SETTINGS_SECTIONS,
-        "strategies": strategies,
-        "bundles": {"enabled": effective.bundles.enabled, "min_commits": effective.bundles.min_commits, "main_only": effective.bundles.main_only},
         "maintenance": {
             "checkpoints": effective.maintenance.checkpoints,
             "interval_secs": effective.maintenance.interval.as_secs(),
             "this_host": {"name": crate::maintain::host_name(st), "maintains": st.cfg.placement.maintains(h.id().owner(), h.id().name()), "serves": st.cfg.placement.serves(h.id().owner(), h.id().name()), "disk": format!("{:?}", st.cfg.maintenance.disk).to_lowercase(), "max_pack_bytes": st.cfg.maintenance.max_pack_bytes.as_u64(), "cache_budget_bytes": st.cfg.cache_budget_bytes(), "roles": st.cfg.server.roles.iter().map(|r| format!("{r:?}").to_lowercase()).collect::<Vec<_>>()},
         },
-        "compaction": {"enabled": effective.compaction.enabled, "trigger_packs": effective.compaction.trigger_packs, "trigger_bytes": effective.compaction.trigger_bytes.as_u64()},
+        "packs": {"enabled": effective.packs.enabled, "fold_when_fresh_packs_reach": effective.packs.fold_when_fresh_packs_reach, "fold_when_max_age_secs": effective.packs.fold_when_max_age.as_secs(), "segment_max_bytes": effective.packs.segment_max_bytes.as_u64(), "freeze_when_settled_secs": effective.packs.freeze_when_settled.as_secs()},
         // D33: what this repository follows and what the last round on this instance did.
         "upstream": {
             "git": effective.upstream.git,
@@ -342,51 +312,7 @@ fn describe_json(
     }))
 }
 
-/// "0 0 23 * * Sun" → "Sundays at 23:00 UTC"; "@hourly" → "every hour".
-fn human_schedule(expr: &str) -> String {
-    match expr.trim() {
-        "@hourly" => return "every hour, at :00 UTC".into(),
-        "@daily" | "@midnight" => return "every day at 00:00 UTC".into(),
-        "@weekly" => return "Sundays at 00:00 UTC".into(),
-        _ => {}
-    }
-    let f: Vec<&str> = expr.split_whitespace().collect();
-    if f.len() != 6 {
-        return expr.to_string();
-    }
-    let (sec, min, hour, dom, mon, dow) = (f[0], f[1], f[2], f[3], f[4], f[5]);
-    let hm = match (hour.parse::<u32>(), min.parse::<u32>()) {
-        (Ok(h), Ok(m)) => format!("at {h:02}:{m:02} UTC"),
-        _ if hour == "*" && min.parse::<u32>().is_ok() => {
-            format!("every hour at :{:02} UTC", min.parse::<u32>().unwrap())
-        }
-        _ => format!("at {hour}:{min}"),
-    };
-    let day = if dow != "*" && dow != "?" {
-        let lower = dow.to_ascii_lowercase();
-        let name = match lower.as_str() {
-            "0" | "7" | "sun" => "Sundays",
-            "1" | "mon" => "Mondays",
-            "2" | "tue" => "Tuesdays",
-            "3" | "wed" => "Wednesdays",
-            "4" | "thu" => "Thursdays",
-            "5" | "fri" => "Fridays",
-            "6" | "sat" => "Saturdays",
-            other => other,
-        };
-        name.to_string()
-    } else if dom != "*" && dom != "?" {
-        format!("day {dom} of the month")
-    } else if hour == "*" {
-        String::new()
-    } else {
-        "every day".to_string()
-    };
-    let _ = (sec, mon);
-    format!("{day} {hm}").trim().to_string()
-}
-
-/// `POST …/settings/validate` body = TOML: `{ok, errors[], strategies[], fields[]}` —
+/// `POST …/settings/validate` body = TOML: `{ok, errors[], fields[]}` —
 /// the describe of the *would-be* effective config, without publishing.
 pub async fn http_validate(
     st: &AppState,
diff --git a/crates/walgit-server/src/setup.rs b/crates/walgit-server/src/setup.rs
index 65a2d30..5ebcf86 100644
--- a/crates/walgit-server/src/setup.rs
+++ b/crates/walgit-server/src/setup.rs
@@ -61,14 +61,10 @@ pub struct Recipes {
     pub install_url: String,
     /// One-shot clone with a token in the environment, no helper.
     pub manual_clone: String,
-    /// Plain clone once the helper is installed (still carries `-c fetch.bundleURI=<list>`: git records
-    /// no list URI for an *advertised* bundle-uri clone, and without one every later `git fetch`
-    /// skips bundles — fast catch-up through them is the point).
+    /// Plain clone once the helper is installed.
     pub plain_clone: String,
-    /// The developer shape for big repositories: blobless, sparse, from the blobless bundle family.
+    /// The developer shape for big repositories: blobless and sparse.
     pub blobless_clone: String,
-    /// The unfiltered bundle list of the repository (what `--bundle-uri` points at).
-    pub bundle_list: String,
     /// Multi-line setup text (auth errors, overview `setup` field).
     pub setup_text: String,
     /// Self-signed TLS: where this host's certificate is published, and the one-time
@@ -118,23 +114,13 @@ pub fn recipes(cfg: &Config, base_url: &str, repo: Option<&str>) -> Recipes {
         Some(r) => format!("{base_url}/{r}.git"),
         None => format!("{base_url}/<owner>/<repo>.git"),
     };
-    // `fetch.bundleURI` on every clone: `git clone -c k=v` persists into the new repository's config,
-    // and `git fetch` consults bundles only through that key.
-    let bundle_list = format!("{url}/bundles/list");
-    // Fetches record the catch-up list (incrementals only): a client with history never needs a
-    // full, and git downloads any full newer than its token.
-    let catchup = format!("{url}/bundles/catchup");
     let manual_clone = if needs_token(cfg) {
-        format!(
-            "git -c http.extraHeader=\"Authorization: Bearer $WALGIT_TOKEN\" -c transfer.bundleURI=true -c fetch.bundleURI={catchup} clone {url}"
-        )
+        format!("git -c http.extraHeader=\"Authorization: Bearer $WALGIT_TOKEN\" clone {url}")
     } else {
-        format!("git -c transfer.bundleURI=true -c fetch.bundleURI={catchup} clone {url}")
+        format!("git clone {url}")
     };
-    let plain_clone = format!("git clone -c fetch.bundleURI={catchup} {url}");
-    let blobless_clone = format!(
-        "git clone --filter=blob:none --sparse --bundle-uri={bundle_list}?filter=blob:none -c fetch.bundleURI={catchup}?filter=blob:none {url}"
-    );
+    let plain_clone = format!("git clone {url}");
+    let blobless_clone = format!("git clone --filter=blob:none --sparse {url}");
     let trust_text = match &trust {
         Some(_) => format!(
             "# {host} presents a self-signed certificate: the installer pins it for git; browsers accept it once.\n"
@@ -148,14 +134,14 @@ pub fn recipes(cfg: &Config, base_url: &str, repo: Option<&str>) -> Recipes {
     };
     let setup_text = match repo {
         Some(_) => format!(
-            "{trust_text}{where_from}# Run once per machine (installs the git credential helper, enables bundle URIs and clones; safe to re-run):\n\
+            "{trust_text}{where_from}# Run once per machine (installs the git credential helper and clones; safe to re-run):\n\
              {install}\n\
              \n\
              # Already set up? {plain_clone}\n\
              # One-shot (CI): {manual_clone}\n"
         ),
         None => format!(
-            "{trust_text}{where_from}# Run once per machine (installs the git credential helper and enables bundle URIs; safe to re-run):\n\
+            "{trust_text}{where_from}# Run once per machine (installs the git credential helper; safe to re-run):\n\
              {install}\n\
              {plain_clone}\n\
              \n\
@@ -171,7 +157,6 @@ pub fn recipes(cfg: &Config, base_url: &str, repo: Option<&str>) -> Recipes {
         manual_clone,
         plain_clone,
         blobless_clone,
-        bundle_list,
         setup_text,
         ca_url,
         trust,
@@ -233,8 +218,8 @@ esac
 /// git ≥ 2.46 + curl → (self-signed: pin `/services/public/ca.pem`) → the credential helper → a token
 /// (`$WALGIT_TOKEN`, an already stored one, or asked for on the terminal; no terminal: exit 2 with the
 /// two things to do) → git config for the host (`credential.<host>.helper` = exactly ours,
-/// `transfer.bundleURI true`, `fetch.uriProtocols https`, stale `fetch.bundleURI`/`extraHeader` removed)
-/// → self-test (`/api/v1/me`, or `git ls-remote` of `repo`) → with `repo`, `git clone -c fetch.bundleURI=… `.
+/// stale `extraHeader` removed)
+/// → self-test (`/api/v1/me`, or `git ls-remote` of `repo`) → with `repo`, `git clone`.
 pub fn install_script(cfg: &Config, base_url: &str, repo: Option<&str>) -> String {
     let r = recipes(cfg, base_url, repo);
     let host = &r.host;
@@ -308,7 +293,7 @@ pub fn install_script(cfg: &Config, base_url: &str, repo: Option<&str>) -> Strin
     };
     let tail = match repo {
         Some(_) => format!(
-            "echo \"$HOST: ready — cloning (history from static bundles, fetches stay on them)\"\n\
+            "echo \"$HOST: ready — cloning\"\n\
              exec {plain}\n",
             plain = r.plain_clone,
         ),
@@ -339,7 +324,7 @@ pub fn install_script(cfg: &Config, base_url: &str, repo: Option<&str>) -> Strin
         r#"#!/bin/sh
 # {host} — git setup in one command, idempotent (re-run any time; each step converges):
 #   stores an access token for https://{host} in a file only you can read, installs a git
-#   credential helper that hands it to git, enables bundle URIs, self-tests, and with
+#   credential helper that hands it to git, self-tests, and with
 #   ?repo=owner/name clones that repository right away.
 # Remove: git config --global --remove-section credential.https://{host}; rm -f ~/.config/git/{token_file}
 set -eu
@@ -351,7 +336,7 @@ command -v curl >/dev/null 2>&1 || {{ echo "$HOST: curl not found" >&2; exit 1;
 GV="$(git --version | sed 's/^git version //; s/[^0-9.].*$//')"
 GMAJ="${{GV%%.*}}"; GREST="${{GV#*.}}"; GMIN="${{GREST%%.*}}"
 [ "$GMAJ" -gt 2 ] 2>/dev/null || [ "$GMAJ" -eq 2 ] && [ "${{GMIN:-0}}" -ge 46 ] || {{
-  echo "$HOST: git $GV is too old — need git >= 2.46 (credential authtype, bundle URIs)" >&2; exit 1; }}
+  echo "$HOST: git $GV is too old — need git >= 2.46 (credential authtype)" >&2; exit 1; }}
 mkdir -p "$DIR"
 {trust}{token}cat > "$HELPER.tmp" <<'{delim}'
 {helper}{delim}
@@ -362,11 +347,6 @@ if cmp -s "$HELPER.tmp" "$HELPER" 2>/dev/null; then rm -f "$HELPER.tmp"; else mv
 git config --global --replace-all "credential.https://$HOST.helper" ""
 git config --global --add "credential.https://$HOST.helper" "$HELPER"
 git config --global --unset-all "http.https://$HOST/.extraHeader" 2>/dev/null || true
-git config --global transfer.bundleURI true
-# fetch.bundleURI is a *URI*, recorded per clone (the clone command below sets it); a global
-# `true` makes every fetch warn "failed to download bundle from URI 'true'".
-git config --global --unset-all fetch.bundleURI 2>/dev/null || true
-git config --global fetch.uriProtocols https
 {self_test}{tail}"#,
         helper_file = helper_file(host),
         token_file = token_file(host),
@@ -436,12 +416,18 @@ mod tests {
             r.manual_clone
                 .contains("Authorization: Bearer $WALGIT_TOKEN")
         );
-        assert!(r.manual_clone.contains("-c fetch.bundleURI=https://git.example.com/acme/monorepo.git/bundles/catchup clone https://git.example.com/acme/monorepo.git"));
+        assert!(
+            r.manual_clone
+                .ends_with("clone https://git.example.com/acme/monorepo.git")
+        );
         assert_eq!(
             r.plain_clone,
-            "git clone -c fetch.bundleURI=https://git.example.com/acme/monorepo.git/bundles/catchup https://git.example.com/acme/monorepo.git"
+            "git clone https://git.example.com/acme/monorepo.git"
+        );
+        assert_eq!(
+            r.blobless_clone,
+            "git clone --filter=blob:none --sparse https://git.example.com/acme/monorepo.git"
         );
-        assert!(r.blobless_clone.contains("--bundle-uri=https://git.example.com/acme/monorepo.git/bundles/list?filter=blob:none -c fetch.bundleURI=https://git.example.com/acme/monorepo.git/bundles/catchup?filter=blob:none"));
         assert!(
             r.setup_text
                 .starts_with("# Tokens: sign in at https://git.example.com/_auth/tokens"),
@@ -532,9 +518,9 @@ mod tests {
                 "the installer embeds the helper verbatim"
             );
             assert_eq!(
-                script.contains("exec git clone -c fetch.bundleURI=https://git.example.com/acme/monorepo.git/bundles/catchup https://git.example.com/acme/monorepo.git"),
+                script.contains("exec git clone https://git.example.com/acme/monorepo.git"),
                 repo.is_some(),
-                "the clone the installer execs records the bundle list for later fetches"
+                "the installer clones the requested repository"
             );
         }
         // No auth: the installer never asks for a token.
@@ -633,17 +619,7 @@ mod tests {
         let tf = dir.path().join("xdg/git").join(token_file(HOST));
         assert_eq!(std::fs::read_to_string(&tf).unwrap(), "wgt_pasted\n");
         assert_eq!(first.matches("helper = \n").count(), 1, "{first}");
-        for key in ["helper = /", "bundleURI = true", "uriProtocols = https"] {
-            assert_eq!(
-                first.matches(key).count(),
-                1,
-                "{key} exactly once in:\n{first}"
-            );
-        }
-        assert!(
-            !first.contains("fetch]\n\tbundleURI"),
-            "no global fetch.bundleURI:\n{first}"
-        );
+        assert_eq!(first.matches("helper = /").count(), 1, "{first}");
         let files: Vec<_> = std::fs::read_dir(dir.path().join("xdg/git"))
             .unwrap()
             .map(|e| e.unwrap().file_name().into_string().unwrap())
diff --git a/crates/walgit-server/src/smart.rs b/crates/walgit-server/src/smart.rs
index 4659606..ca89d49 100644
--- a/crates/walgit-server/src/smart.rs
+++ b/crates/walgit-server/src/smart.rs
@@ -104,9 +104,10 @@ pub async fn info_refs(
             buf.extend_from_slice(&cached);
         } else {
             let start = buf.len();
+            let cfg = handle.validated_effective_config().map_err(wal_err)?;
             handle
                 .local()
-                .advertise_refs_v0(service, &mut buf)
+                .advertise_refs_v0(service, &mut buf, Some(&cfg.refs.advertise))
                 .map_err(git_err)?;
             let advert_bytes = buf[start..].to_vec();
             st.caches
@@ -133,7 +134,7 @@ fn parse_query(query: &str, key: &str) -> Option<String> {
 /// Build the protocol v2 capability advertisement for upload-pack.
 async fn v2_capability_advert(
     st: &AppState,
-    id: &walgit_git::RepoId,
+    _id: &walgit_git::RepoId,
     handle: &Arc<walgit_wal::RepoHandle>,
     buf: &mut Vec<u8>,
 ) -> Result<(), ApiError> {
@@ -147,9 +148,8 @@ async fn v2_capability_advert(
     }
     // With sideband-all every response line is sideband-framed, which lets us
     // narrate what the server is doing (band 2 → "remote: * …") *before* the
-    // packfile section: auth, WAL sync, materialization progress, bundle-uri
-    // facts. Both engines frame their sections that way.
-    fetch.push_str(" sideband-all");
+    // packfile section: auth, WAL sync, materialization progress. Both engines frame their sections that way.
+    fetch.push_str(" sideband-all packfile-uris packfile-indexes");
     pktline::encode_text(buf, &format!("{fetch}\n"));
     pktline::encode_text(buf, "server-option\n");
     let fmt = match handle.local().object_format() {
@@ -157,11 +157,6 @@ async fn v2_capability_advert(
         walgit_git::ObjectFormat::Sha256 => "sha256",
     };
     pktline::encode_text(buf, &format!("object-format={fmt}\n"));
-    if st.cfg.bundles.advertise
-        && let Ok(Some(_list)) = st.bundles.list(id).await
-    {
-        pktline::encode_text(buf, "bundle-uri\n");
-    }
     pktline::encode_flush(buf);
     Ok(())
 }
@@ -219,7 +214,7 @@ async fn upload_pack_v2(
             };
             let repo_key = route.id.to_string();
             let version = handle.manifest_version();
-            let lines = if let Some(lines) =
+            let mut lines = if let Some(lines) =
                 st.caches
                     .ref_advert
                     .get_v2_ls_refs(&repo_key, version.as_ref(), &args)
@@ -235,6 +230,27 @@ async fn upload_pack_v2(
                 );
                 lines
             };
+            let all_refs = cmd.cap("server-option") == Some("ref-view=all")
+                || cmd
+                    .args
+                    .iter()
+                    .any(|arg| arg == "server-option=ref-view=all");
+            if !all_refs {
+                let cfg = handle.validated_effective_config().map_err(wal_err)?;
+                let refs = handle.local().ref_view().map_err(git_err)?;
+                lines.retain(|line| {
+                    let name = if line.name == "HEAD" {
+                        refs.head_target()
+                    } else {
+                        &line.name
+                    };
+                    walgit_config::refs::selectors_match(
+                        &cfg.refs.advertise,
+                        name,
+                        refs.head_target(),
+                    )
+                });
+            }
             let mut buf = Vec::with_capacity(1024);
             for line in &lines {
                 pktline::encode_text(&mut buf, &line.render(&args));
@@ -271,58 +287,11 @@ async fn upload_pack_v2(
                     git_err_response("git-upload-pack", &msg)
                 });
             }
-            // Policy: listed repos hand clone bytes out as static bundles. A
-            // fetch with zero haves is a clone that skipped bundle-uri —
-            // refuse it with the fix before any sync or pack work.
-            // D17: only an *unbounded* zero-have fetch (no deepen, no filter)
-            // is refused — that is a full clone and belongs to bundle-uri.
-            // `--depth`/`--filter` zero-have fetches are the CI workload and
-            // go to upload-pack.
-            let mut fallback_warning: Option<String> = None;
-            if req.haves.is_empty()
-                && req.deepen.is_none()
-                && req.deepen_since.is_none()
-                && req.deepen_not.is_empty()
-                && req.filter.is_none()
-                && st.cfg.bundles_required(route.id.owner(), route.id.name())
-            {
-                // D17 amendment (2026-08-21): a principal that fetched the bundle
-                // list within the hour TRIED bundle-uri — its zero-have fetch is a
-                // bundle download that failed (git never retries one). Let that
-                // clone succeed through upload-pack, once per 6 h, loudly.
-                if let Some(who) = bundle_fallback_allowed(st, headers, route).await {
-                    tracing::warn!(repo = %route.id, principal = %who, "bundles.require: one-shot upload-pack fallback for a client whose bundle download failed");
-                    metrics::counter!("walgit_bundle_fallback_total", "repo" => route.id.to_string()).increment(1);
-                    fallback_warning = Some(format!(
-                        "walgit: WARNING — your git fetched the bundle list but could not apply the bundles \
-                         (a bundle download failed or was cut; see the warnings above). Serving this clone's \
-                         full history through upload-pack ONCE (≈ 32 GB for acme/monorepo, minutes of server \
-                         time); the next such clone within 6 h is refused. Faster next time: retry the clone \
-                         (bundle downloads are cached at the edge), or the blobless form: \
-                         git clone --filter=blob:none --bundle-uri={base}/{repo}.git/bundles/list?filter=blob:none {base}/{repo}.git",
-                        base = request_base_url(st, headers),
-                        repo = route.id
-                    ));
-                } else {
-                    let msg = bundles_required_message(st, headers, route);
-                    return Ok(if req.sideband_all {
-                        let mut buf = sideband_pkt(3, &msg);
-                        pktline::encode_flush(&mut buf);
-                        text_response(
-                            "application/x-git-upload-pack-result",
-                            no_cache_headers(),
-                            buf,
-                        )
-                    } else {
-                        git_err_response("git-upload-pack", &msg)
-                    });
-                }
-            }
             // Narrated fetch: the client accepted sideband-all and wants
             // progress → stream immediately and say what we are doing while
             // the local copy syncs, then hand over to upload-pack.
             if req.sideband_all && !req.no_progress {
-                return Ok(narrated_fetch(st, route, headers, handle, req, fallback_warning).await);
+                return Ok(narrated_fetch(st, route, headers, handle, req).await);
             }
             // Objects are needed from here on. Surface "too big for this
             // instance" as a pkt-line ERR git prints verbatim (with the fix),
@@ -342,6 +311,7 @@ async fn upload_pack_v2(
             // not be removed mid-clone.
             let handle = handle.clone();
             let engine = st.cfg.git.upload_pack_engine;
+            let uri_base = anonymous_uri_base(st, route, headers);
             tokio::spawn(async move {
                 let guard = match handle.sync().await {
                     Ok(g) => g,
@@ -351,7 +321,7 @@ async fn upload_pack_v2(
                     }
                 };
                 // guard is held until the task ends (after streaming completes).
-                if let Err(e) = run_fetch(&handle, engine, req, writer, None).await {
+                if let Err(e) = run_fetch(&handle, engine, req, writer, uri_base).await {
                     tracing::warn!(error = ?e, "upload_pack v2 fetch failed");
                 }
                 drop(guard);
@@ -381,26 +351,6 @@ async fn upload_pack_v2(
                 sizes_buf,
             ))
         }
-        "bundle-uri" => {
-            let _guard = handle.sync_refs().await.map_err(wal_err)?;
-            let () = walgit_git::pkt::parse_bundle_uri(&cmd);
-            let base = request_base_url(st, headers);
-            let lines = st
-                .bundles
-                .protocol_v2_lines(&route.id, &base)
-                .await
-                .map_err(bundle_err)?;
-            let mut buf = Vec::with_capacity(256);
-            for l in lines {
-                pktline::encode_text(&mut buf, &l);
-            }
-            pktline::encode_flush(&mut buf);
-            Ok(text_response(
-                "application/x-git-upload-pack-result",
-                no_cache_headers(),
-                buf,
-            ))
-        }
         other => Err(ApiError::BadRequest(format!("unknown v2 command: {other}"))),
     }
 }
@@ -428,60 +378,6 @@ async fn say<W: tokio::io::AsyncWrite + Unpin>(w: &mut W, text: &str) -> bool {
     w.write_all(&pkt).await.is_ok() && w.flush().await.is_ok()
 }
 
-/// Band-2 lines about bundles, from the client's point of view. A `have` equal to a listed bundle's
-/// tip means git applied that bundle (fresh clone or catch-up); the rest of the list is summarized
-/// per strategy so the reader knows the shape without an inventory.
-fn bundle_narration(
-    list: &walgit_proto::v1::BundleList,
-    haves: &[gix_hash::ObjectId],
-) -> Vec<String> {
-    let have: std::collections::HashSet<String> =
-        haves.iter().map(|h| h.to_hex().to_string()).collect();
-    let mut applied: Vec<&walgit_proto::v1::BundleEntry> = list
-        .bundles
-        .iter()
-        .filter(|b| b.tips.iter().any(|t| have.contains(&t.oid)))
-        .collect();
-    applied.sort_by_key(|b| b.creation_token);
-    // Per strategy: count and bytes, in list order of first appearance.
-    let mut per: Vec<(String, usize, u64)> = Vec::new();
-    for b in &list.bundles {
-        match per.iter_mut().find(|(s, _, _)| *s == b.strategy) {
-            Some(e) => {
-                e.1 += 1;
-                e.2 += b.size;
-            }
-            None => per.push((b.strategy.clone(), 1, b.size)),
-        }
-    }
-    let shape: Vec<String> = per
-        .iter()
-        .map(|(s, n, bytes)| format!("{n} {s} ({})", human(*bytes)))
-        .collect();
-    let mut out = vec![format!(
-        "bundle-uri: {} listed — {}; git takes the newest full and every incremental above it, this server sends only the rest",
-        list.bundles.len(),
-        shape.join(", ")
-    )];
-    if applied.is_empty() {
-        out.push("bundle-uri: none of your haves is a bundle tip — your git did not use the bundles (clone with the recipe from the Clone menu, or check transfer.bundleURI)".into());
-    } else {
-        let bytes: u64 = applied.iter().map(|b| b.size).sum();
-        let newest = applied.last().map_or(0, |b| b.creation_token);
-        let when = chrono::DateTime::from_timestamp(newest as i64, 0)
-            .map(|d| d.format("%Y-%m-%d %H:%MZ").to_string())
-            .unwrap_or_default();
-        let names: Vec<String> = applied.iter().map(|b| b.strategy.clone()).collect();
-        out.push(format!(
-            "bundle-uri: your git applied {} bundle(s) = {} ({}) — history as of {when}; what follows is everything since",
-            applied.len(),
-            human(bytes),
-            names.join(" → ")
-        ));
-    }
-    out
-}
-
 fn human(n: u64) -> String {
     walgit_wal::remote::human_bytes(n)
 }
@@ -494,12 +390,13 @@ fn human(n: u64) -> String {
 async fn run_fetch<W: tokio::io::AsyncWrite + Unpin + Send>(
     handle: &Arc<walgit_wal::RepoHandle>,
     engine: walgit_config::UploadPackEngine,
-    req: walgit_git::UploadPackRequest,
-    writer: W,
-    _progress: Option<()>,
+    mut req: walgit_git::UploadPackRequest,
+    mut writer: W,
+    uri_base: Option<String>,
 ) -> Result<(), walgit_git::GitError> {
     let local = handle.local().clone();
     if !handle.remote_served().is_empty() {
+        warn_large_dynamic_clone(handle, &req, &mut writer).await;
         let reader = handle
             .remote_reader()
             .await
@@ -540,11 +437,21 @@ async fn run_fetch<W: tokio::io::AsyncWrite + Unpin + Send>(
         e => e,
     };
     match engine {
-        walgit_config::UploadPackEngine::Gix | walgit_config::UploadPackEngine::Auto => local
-            .upload_pack_gix_with(req, writer, None)
-            .await
-            .map(|_| ()),
+        walgit_config::UploadPackEngine::Gix | walgit_config::UploadPackEngine::Auto => {
+            warn_large_dynamic_clone(handle, &req, &mut writer).await;
+            local
+                .upload_pack_gix_with(req, writer, None)
+                .await
+                .map(|_| ())
+        }
         walgit_config::UploadPackEngine::Git => {
+            if let Some(base) = uri_base
+                && let Some(selection) = crate::packfile_uri::select(handle, &req, &base).await
+            {
+                return local.upload_pack_with_uris(req, &selection, writer).await;
+            }
+            warn_large_dynamic_clone(handle, &req, &mut writer).await;
+            req.packfile_uris_protocols.clear();
             let body = walgit_git::build_v2_fetch_request(&req);
             local
                 .upload_pack_raw(walgit_git::pkt::Protocol::V2, &body[..], writer)
@@ -553,6 +460,41 @@ async fn run_fetch<W: tokio::io::AsyncWrite + Unpin + Send>(
     }
 }
 
+async fn warn_large_dynamic_clone<W: tokio::io::AsyncWrite + Unpin>(
+    handle: &walgit_wal::RepoHandle,
+    request: &walgit_git::UploadPackRequest,
+    writer: &mut W,
+) {
+    if request.sideband_all
+        && !request.no_progress
+        && request.done
+        && request.haves.is_empty()
+        && request.filter.is_none()
+        && request.deepen.is_none()
+        && request.deepen_since.is_none()
+        && request.deepen_not.is_empty()
+        && request.shallow.is_empty()
+        && handle
+            .manifest()
+            .packs
+            .iter()
+            .map(|p| p.pack_size)
+            .sum::<u64>()
+            >= handle
+                .effective_config()
+                .packfile_uri
+                .uri_min_bytes
+                .as_u64()
+    {
+        let _ = say(writer, "WARNING: reusable pack delivery is unavailable for this request; this full clone uses dynamic transfer and may take longer. Use a shallow or filtered clone when appropriate.").await;
+    }
+}
+
+fn anonymous_uri_base(st: &AppState, route: &RepoRoute, headers: &HeaderMap) -> Option<String> {
+    (st.cfg.server.auth.mode == walgit_config::AuthMode::None || st.cfg.server.auth.anonymous_read)
+        .then(|| format!("{}/{}", request_base_url(st, headers), route.id))
+}
+
 /// `handle.sync()` while narrating on band 2: the repo's progress packets
 /// (notices, bars, task changes) as they happen, and a heartbeat every 5 s so
 /// the connection never goes silent (a serverless host's frontend cut a push that
@@ -621,7 +563,6 @@ async fn narrated_fetch(
     headers: &HeaderMap,
     handle: &Arc<walgit_wal::RepoHandle>,
     req: walgit_git::UploadPackRequest,
-    fallback_warning: Option<String>,
 ) -> Response {
     let (mut writer, body) = write_body_pipe(256 * 1024);
     let handle = handle.clone();
@@ -632,15 +573,9 @@ async fn narrated_fetch(
         .await
         .ok()
         .map_or_else(|| "anonymous".into(), |p| p.name);
-    // Nothing that can wait (store reads, syncs) happens before the stream
-    // is open and the first band-2 line is out: the bundle facts are read
-    // inside the task, after the greeting.
-    let advertise_bundles = st.cfg.bundles.advertise;
-    let bundles_svc = st.bundles.clone();
-    let route_id = route.id.clone();
-    let base = request_base_url(st, headers);
     let cache_max = st.cfg.cache_budget_bytes();
     let engine = st.cfg.git.upload_pack_engine;
+    let uri_base = anonymous_uri_base(st, route, headers);
     let max_wants = st.cfg.git.max_wants;
     tokio::spawn(async move {
         use tokio::io::AsyncWriteExt;
@@ -653,25 +588,7 @@ async fn narrated_fetch(
         {
             return;
         }
-        if let Some(w) = &fallback_warning
-            && !say(&mut writer, w).await
-        {
-            return;
-        }
         let applied = handle.applied_seq();
-        // What the bundles did for THIS client, not the inventory: by the time git sends `fetch` it
-        // has applied the bundles it downloaded, and its `have`s are exactly their tips — so name
-        // them, sum their bytes, and say what the rest of the list was (the bundle-uri *command*
-        // is a plain pkt response and cannot narrate; the fetch does it right after the greeting).
-        let bundle_lines: Vec<String> = if advertise_bundles {
-            match bundles_svc.list(&route_id).await {
-                Ok(Some(l)) if !l.bundles.is_empty() => bundle_narration(&l, &req.haves),
-                Ok(_) => vec!["bundle-uri: no bundles published yet — this clone's history comes through upload-pack".into()],
-                Err(e) => vec![format!("bundle-uri: list unavailable ({e})")],
-            }
-        } else {
-            Vec::new()
-        };
         let _ = say(
             &mut writer,
             &format!(
@@ -686,9 +603,6 @@ async fn narrated_fetch(
             ),
         )
         .await;
-        for l in &bundle_lines {
-            let _ = say(&mut writer, l).await;
-        }
         // The initial fetch of a blobless clone is the one moment the user can still be told: the
         // lazy blob fetch that follows a checkout carries `no-progress`, so nothing said there is seen.
         if req.haves.is_empty()
@@ -715,7 +629,7 @@ async fn narrated_fetch(
             Err(e) => {
                 let msg = match &e {
                     walgit_wal::WalError::TooLarge { bytes, max } => format!(
-                        "walgit: this repository's pack set is {} — larger than this instance's cache ({}); clone it with bundle-uri:\n  git config --global transfer.bundleURI true\n  git clone {base}/{repo}.git\n(bundle list: {base}/{repo}.git/bundles/list)",
+                        "walgit: this repository's pack set is {} — larger than this instance's cache ({}); retry on a host with enough capacity or use a bounded clone",
                         human(*bytes),
                         human(if *max == 0 { cache_max } else { *max })
                     ),
@@ -743,7 +657,7 @@ async fn narrated_fetch(
             ),
         )
         .await;
-        if let Err(e) = run_fetch(&handle, engine, req, writer, None).await {
+        if let Err(e) = run_fetch(&handle, engine, req, writer, uri_base).await {
             tracing::warn!(error = ?e, "narrated upload_pack v2 fetch failed");
         }
         drop(guard);
@@ -760,65 +674,11 @@ async fn upload_pack_v0(
     route: &RepoRoute,
     headers: &HeaderMap,
     handle: &Arc<walgit_wal::RepoHandle>,
-    mut reader: Box<dyn tokio::io::AsyncRead + Unpin + Send>,
+    reader: Box<dyn tokio::io::AsyncRead + Unpin + Send>,
 ) -> Result<Response, ApiError> {
     if let Some(r) = not_served_here(st, &route.id, "git-upload-pack").await {
         return Ok(r);
     }
-    // bundles.require (see the v2 path): a v0 request lists its haves in the
-    // body; buffer it (negotiation bodies are small) to look.
-    if st.cfg.bundles_required(route.id.owner(), route.id.name()) {
-        use tokio::io::AsyncReadExt;
-        const MAX: usize = 16 * 1024 * 1024;
-        let mut buf = Vec::new();
-        let mut chunk = vec![0u8; 64 * 1024];
-        loop {
-            let n = reader
-                .read(&mut chunk)
-                .await
-                .map_err(|e| ApiError::BadRequest(format!("body read: {e}")))?;
-            if n == 0 {
-                break;
-            }
-            buf.extend_from_slice(&chunk[..n]);
-            if buf.len() > MAX {
-                return Err(ApiError::BadRequest("upload-pack request too large".into()));
-            }
-        }
-        // Walk the pkt-lines: haves, and the bounding lines (`deepen*`,
-        // `filter`) — capability words on the first want line also say
-        // "deepen-since", so look at line starts, not substrings.
-        let (mut has_have, mut bounded, mut pos) = (false, false, 0usize);
-        while pos + 4 <= buf.len() {
-            let Ok(len) =
-                usize::from_str_radix(std::str::from_utf8(&buf[pos..pos + 4]).unwrap_or("zz"), 16)
-            else {
-                break;
-            };
-            if len < 4 {
-                pos += 4; // flush / delim
-                continue;
-            }
-            let line = &buf[(pos + 4).min(buf.len())..(pos + len).min(buf.len())];
-            if line.starts_with(b"have ") {
-                has_have = true;
-            }
-            if line.starts_with(b"deepen") || line.starts_with(b"filter ") {
-                bounded = true;
-            }
-            if line.starts_with(b"done") {
-                break;
-            }
-            pos += len;
-        }
-        if !has_have && !bounded {
-            return Ok(git_err_response(
-                "git-upload-pack",
-                &bundles_required_message(st, headers, route),
-            ));
-        }
-        reader = Box::new(std::io::Cursor::new(buf));
-    }
     if let Err(e) = handle.sync().await {
         return Ok(match e {
             walgit_wal::WalError::TooLarge { .. } => git_err_response(
@@ -945,9 +805,9 @@ pub async fn receive_pack(
         .await;
     }
 
-    // Bodies no larger than the configured replay buffer can safely fall back
-    // to local publish. Larger (or chunked/unknown-length) bodies stay fully
-    // streaming; if the broker fails, return 503 rather than double-publish.
+    // Buffering preserves a body, not permission to replay it. Only proven
+    // pre-delivery failure permits local fallback; ambiguous delivery never does.
+    // Larger (or unknown-length) requests stay fully streaming.
     let already_forwarded = headers
         .get("x-walgit-forwarded")
         .and_then(|v| v.to_str().ok())
@@ -993,6 +853,13 @@ pub async fn receive_pack(
         .await
         {
             crate::forward::ForwardOutcome::Response(response) => return Ok(response),
+            crate::forward::ForwardOutcome::Ambiguous => {
+                return Ok((
+                    StatusCode::BAD_GATEWAY,
+                    "push broker response lost; outcome unknown; inspect remote refs before retrying",
+                )
+                    .into_response());
+            }
             crate::forward::ForwardOutcome::Fallback => {
                 if let Some(bytes) = fallback_bytes {
                     metrics::counter!("walgit_push_forwarded_total", "outcome" => "fallback")
@@ -1415,6 +1282,7 @@ async fn parse_fetch_request(
         shallow: Vec::new(),
         want_refs: Vec::new(),
         packfile_uris_protocols: Vec::new(),
+        packfile_indexes: false,
     };
     loop {
         let line = walgit_git::pkt::read_pkt_line(&mut reader)
@@ -1464,7 +1332,9 @@ async fn parse_fetch_request(
                 } else if let Some(r) = s.strip_prefix("want-ref ") {
                     req.want_refs.push(r.to_string());
                 } else if let Some(p) = s.strip_prefix("packfile-uris ") {
-                    req.packfile_uris_protocols = p.split(' ').map(String::from).collect();
+                    req.packfile_uris_protocols = p.split(',').map(String::from).collect();
+                } else if s == "packfile-indexes" {
+                    req.packfile_indexes = true;
                 }
             }
         }
@@ -1613,76 +1483,8 @@ fn too_large_message(
 ) -> String {
     let base = request_base_url(st, headers);
     format!(
-        "walgit: {e}.\n\
-         This repository is served from static bundles; clone it with bundle-uri enabled:\n\
-         \n\
-           git config --global transfer.bundleURI true\n\
-           git clone {base}/{}.git\n\
-         \n\
-         (bundle list: {base}/{}.git/bundles/list)\n",
-        route.id, route.id
-    )
-}
-
-/// How often one principal may fall back to an upload-pack full clone of a
-/// `bundles.require` repository.
-const FALLBACK_EVERY: std::time::Duration = std::time::Duration::from_hours(6);
-/// How recent the principal's `bundles/list` fetch must be to count as "tried".
-const ATTEMPT_WINDOW: std::time::Duration = std::time::Duration::from_hours(1);
-
-/// D17 amendment: `Some(principal)` when this zero-have full fetch may go to
-/// upload-pack — the principal fetched the repo's bundle list within the hour
-/// (it tried bundle-uri; git does not retry a failed bundle download) and has
-/// not used the fallback in the last `FALLBACK_EVERY`. Records the use.
-async fn bundle_fallback_allowed(
-    st: &AppState,
-    headers: &HeaderMap,
-    route: &RepoRoute,
-) -> Option<String> {
-    let who = st.auth.require_read(headers).await.ok()?.name;
-    if who.is_empty() || who == "anonymous" {
-        return None;
-    }
-    let key = format!("{}\0{}", route.id, who);
-    let tried = st.caches.bundle_attempts.get(&key)?;
-    if tried.elapsed() > ATTEMPT_WINDOW {
-        return None;
-    }
-    let fkey = format!("{key}\0fallback");
-    if st
-        .caches
-        .bundle_attempts
-        .get(&fkey)
-        .is_some_and(|t| t.elapsed() < FALLBACK_EVERY)
-    {
-        return None;
-    }
-    st.caches
-        .bundle_attempts
-        .insert(fkey, std::time::Instant::now());
-    Some(who)
-}
-
-/// `bundles.require`: what a zero-have fetch is told when it may not fall back:
-/// either it never tried bundle-uri, or it already used its one fallback.
-fn bundles_required_message(st: &AppState, headers: &HeaderMap, route: &RepoRoute) -> String {
-    let base = request_base_url(st, headers);
-    format!(
-        "walgit: {repo} is served from static bundles; a full clone fetches its history through bundle-uri \
-         (this request had no haves, no depth and no filter).\n\
-         \n\
-         If git printed 'failed to download bundle' above: a bundle download failed or was cut and git does not \
-         retry it. Retry the clone (downloads are cached at the edge) — one clone per 6 h may fall back to \
-         upload-pack after a failed attempt; you may have used it.\n\
-         Otherwise turn bundle-uri on:\n\
-         \n\
-           git config --global transfer.bundleURI true\n\
-           git clone {base}/{repo}.git\n\
-         \n\
-         Blobless (developer shape): git clone --filter=blob:none --bundle-uri={base}/{repo}.git/bundles/list?filter=blob:none {base}/{repo}.git\n\
-         CI / shallow: git clone --depth=1 … (never refused). Already cloned? `git fetch` works as usual.\n\
-         Bundle list: {base}/{repo}.git/bundles/list\n",
-        repo = route.id,
+        "walgit: {e}. Retry on a host with enough capacity, or use a bounded clone:\n  git clone --depth=1 {base}/{}.git\n",
+        route.id
     )
 }
 
@@ -1736,9 +1538,9 @@ fn too_many_wants_message(
         "walgit: this fetch asks for {wants} objects at once (this host's bound is {max}). That is what a \
          `git clone --filter=blob:none` does right after cloning when it checks out HEAD: every blob of the tree \
          in one request. Clone blobless with a sparse or no checkout instead, then fetch blobs as you need them:\n  \
-         git clone --filter=blob:none --sparse --bundle-uri={base}/{repo}.git/bundles/list?filter=blob:none {base}/{repo}.git\n  \
-         git sparse-checkout add <dir>…\nor, for the whole tree, a full clone through bundles: \
-         git clone -c fetch.bundleURI={base}/{repo}.git/bundles/catchup {base}/{repo}.git",
+         git clone --filter=blob:none --sparse {base}/{repo}.git\n  \
+         git sparse-checkout add <dir>…\nor, for the whole tree, a full clone: \
+         git clone {base}/{repo}.git",
         max = st.cfg.git.max_wants,
     )
 }
@@ -1757,7 +1559,7 @@ fn git_err_response(service: &str, msg: &str) -> Response {
     )
 }
 
-fn auth_err(e: crate::auth::AuthError) -> ApiError {
+pub(crate) fn auth_err(e: crate::auth::AuthError) -> ApiError {
     match e {
         crate::auth::AuthError::Invalid | crate::auth::AuthError::Unauthorized => {
             ApiError::Unauthorized
@@ -1783,6 +1585,3 @@ pub(crate) fn wal_err(e: walgit_wal::WalError) -> ApiError {
         _ => ApiError::Internal(format!("wal: {e}")),
     }
 }
-fn bundle_err(e: walgit_bundle::BundleError) -> ApiError {
-    ApiError::Internal(format!("bundle: {e}"))
-}
diff --git a/crates/walgit-server/src/static_object.rs b/crates/walgit-server/src/static_object.rs
index 2c714f5..03a02bb 100644
--- a/crates/walgit-server/src/static_object.rs
+++ b/crates/walgit-server/src/static_object.rs
@@ -1,4 +1,4 @@
-//! HTTP serving of immutable store objects (bundles, LFS objects, packs) with
+//! HTTP serving of immutable store objects (LFS objects, packs) with
 //! the complete conditional/range contract a CDN or `git` expects:
 //!
 //! * strong `ETag` = the store version (GCS generation / S3 `ETag`), quoted;
@@ -140,13 +140,9 @@ fn if_none_match_hit(headers: &HeaderMap, version: &Version) -> bool {
 /// range is ignored and the full body is sent (RFC 9110 §13.1.5). Dates are
 /// not supported (we have no `Last-Modified`) and therefore also ignored.
 fn if_range_allows(headers: &HeaderMap, version: &Version) -> bool {
-    match headers.get(header::IF_RANGE).and_then(|v| v.to_str().ok()) {
+    match headers.get(header::IF_RANGE) {
         None => true,
-        Some(v) if v.contains('"') => {
-            v.trim().trim_start_matches("W/").trim_matches('"')
-                == version.as_str().trim_matches('"')
-        }
-        Some(_) => false,
+        Some(value) => value.to_str().is_ok_and(|v| v.trim() == etag_of(version)),
     }
 }
 
@@ -241,7 +237,7 @@ pub async fn serve(
     // Edge offload: the nginx in front told us it honours X-Accel-Redirect. We
     // still do auth (the caller did), existence, strong validators and 304 here;
     // nginx fetches the object with its own credentials, slices Range itself and
-    // caches the bytes on its disk, so a 32 GB bundle never ties up a worker on
+    // caches the bytes on its disk, so a large static object never ties up a worker on
     // this instance. HEAD stays local (metadata only, nothing to offload).
     if opts.accel
         && !head
@@ -464,6 +460,10 @@ mod tests {
         h.insert(header::IF_RANGE, HeaderValue::from_static("\"123\""));
         assert!(if_range_allows(&h, &Version::new("123")));
         assert!(!if_range_allows(&h, &Version::new("124")));
+        for value in ["W/\"123\"", "123", "\"\"123\"\"", "\"123\", \"124\""] {
+            h.insert(header::IF_RANGE, HeaderValue::from_str(value).unwrap());
+            assert!(!if_range_allows(&h, &Version::new("123")), "{value}");
+        }
         h.insert(
             header::IF_RANGE,
             HeaderValue::from_static("Wed, 21 Oct 2015 07:28:00 GMT"),
diff --git a/crates/walgit-server/src/telemetry.rs b/crates/walgit-server/src/telemetry.rs
index 59ad1bc..b12609b 100644
--- a/crates/walgit-server/src/telemetry.rs
+++ b/crates/walgit-server/src/telemetry.rs
@@ -168,7 +168,6 @@ impl CloudLoggingLayer {
             "task" => "task",
             "push" => "push",
             "maintain" => "maintain",
-            "bundle" => "bundle",
             "remote" => "remote",
             _ => "other",
         }
diff --git a/crates/walgit-server/src/web/login.rs b/crates/walgit-server/src/web/login.rs
index 0cdcfc2..7067469 100644
--- a/crates/walgit-server/src/web/login.rs
+++ b/crates/walgit-server/src/web/login.rs
@@ -560,8 +560,7 @@ document.getElementById('mint').onclick = async () => {
     `git config --global credential.https://${host}.helper store
 ` +
     `printf 'protocol=https\nhost=${host}\nusername=${j.principal}\npassword=${j.token}\n' | git credential approve
-` +
-    `git config --global transfer.bundleURI true`;
+`;
   document.getElementById('out').hidden = false;
   document.getElementById('mint').disabled = true;
 };
diff --git a/crates/walgit-server/src/web/ui.rs b/crates/walgit-server/src/web/ui.rs
index 4faaf0a..dad07f5 100644
--- a/crates/walgit-server/src/web/ui.rs
+++ b/crates/walgit-server/src/web/ui.rs
@@ -8,11 +8,9 @@ use axum::extract::{Path as AxumPath, State};
 use axum::http::{HeaderMap, HeaderValue, Method, Request, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum::routing::get;
-use prost::Message;
 use rust_embed::RustEmbed;
 use serde::Serialize;
-use walgit_proto::v1::{Checkpoint, EntryKind};
-use walgit_store::{GetOptions, GetResult, ObjectStore};
+use walgit_proto::v1::EntryKind;
 
 use crate::AppState;
 use crate::error::ApiError;
@@ -165,7 +163,7 @@ pub struct InstallQuery {
     tree: Option<String>,
 }
 
-/// `/services/public/install.sh[?repo=owner/name]`: the ONE idempotent client setup command — token, credential helper, bundle URIs, self-test, and with
+/// `/services/public/install.sh[?repo=owner/name]`: the ONE idempotent client setup command — token, credential helper, self-test, and with
 /// `repo` the clone. Open at the app (no credential exists yet when it is fetched).
 pub async fn install_sh(
     State(state): State<Arc<AppState>>,
@@ -371,7 +369,7 @@ struct Overview {
     /// Which instance rendered this page (kind, name, shape, build).
     instance: crate::instance::InstanceInfo,
     clone_url: String,
-    /// One-time git setup for this host (credential helper + bundle-uri), multi-line.
+    /// One-time git setup for this host (credential helper), multi-line.
     setup: String,
     /// `curl -fsSL …/services/public/install.sh | sh` one-liner (the open lane; no token needed).
     install: String,
@@ -382,10 +380,7 @@ struct Overview {
     manifest: ManifestInfo,
     local: LocalInfo,
     packs: PacksInfo,
-    bundles: Vec<BundleInfo>,
-    /// Calendar slot table (built / missing / unavailable / wrong-host) and
-    /// who maintains this repository (heartbeats). See `walgit bundle plan`.
-    bundle_plan: BundlePlanInfo,
+    maintenance: MaintenanceInfo,
     compactions: Vec<CompactionInfo>,
     node: serde_json::Map<String, serde_json::Value>,
     ops: OpsInfo,
@@ -394,27 +389,11 @@ struct Overview {
 }
 
 #[derive(Serialize, Default)]
-struct BundlePlanInfo {
-    slots: Vec<SlotInfo>,
-    /// The next slot of each strategy and the unit it will run (Sunday's base rebuild, visibly).
-    upcoming: Vec<crate::maintain::Upcoming>,
+struct MaintenanceInfo {
     maintainers: Vec<MaintainerInfo>,
-    /// True when no live heartbeat covers this repository.
     orphaned: bool,
 }
 
-#[derive(Serialize)]
-struct SlotInfo {
-    strategy: String,
-    kind: String,
-    /// Slot epoch seconds (0 = chain-level row).
-    slot: u64,
-    /// `built` | `missing` | `blocked` | `unavailable` | `wrong-host`
-    status: String,
-    detail: String,
-    bundle_id: Option<String>,
-}
-
 #[derive(Serialize)]
 struct MaintainerInfo {
     host: String,
@@ -463,8 +442,6 @@ struct OpsInfo {
     /// Recent + running tasks on this instance (ops and automatic ones:
     /// materialize, remote-index).
     recent: Vec<walgit_wal::TaskRecord>,
-    /// Configured bundle strategies (for the bundle op's `strategy` param).
-    bundle_strategies: Vec<String>,
 }
 
 #[derive(Serialize)]
@@ -476,12 +453,8 @@ struct ManifestInfo {
     tail_entries: usize,
     entries: usize,
     #[serde(skip_serializing_if = "Option::is_none")]
-    checkpoint: Option<BundleInfo>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     packset: Option<PacksetInfo>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    advertised_bundle_uri: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
     last_push: Option<String>,
 }
 
@@ -502,30 +475,6 @@ struct PacksetInfo {
     creator: String,
 }
 
-#[derive(Serialize)]
-struct BundleInfo {
-    sha: String,
-    size: u64,
-    at_seq: u64,
-    created: String,
-    creator: String,
-    uri: String,
-    /// Chain facts (empty for the checkpoint bundle): strategy, full|incremental, the bundle whose
-    /// tips are this one's prerequisites (empty for a full), creationToken, object filter, ref tips.
-    #[serde(default)]
-    strategy: String,
-    #[serde(default)]
-    kind: String,
-    #[serde(default)]
-    base_id: String,
-    #[serde(default)]
-    creation_token: u64,
-    #[serde(default)]
-    filter: String,
-    #[serde(default)]
-    tips: Vec<(String, String)>,
-}
-
 #[derive(Serialize)]
 struct LocalInfo {
     version: String,
@@ -596,7 +545,6 @@ async fn overview(
     let recipes = crate::setup::recipes(&state.cfg, &base_url, Some(&id.to_string()));
     let setup = recipes.setup_text.clone();
 
-    let checkpoint = checkpoint_info(&handle, &manifest, &base_url).await?;
     let created = manifest
         .updated_at
         .as_ref()
@@ -675,7 +623,6 @@ async fn overview(
             block_cache_bytes: cached,
         }
     });
-    let bundles = bundle_infos(&state, &id, &base_url).await?;
 
     // Health + suggestions.
     let mut issues = Vec::new();
@@ -692,7 +639,7 @@ async fn overview(
         // D25: no budget on the SSD host — never the too-large path.
     } else if !handle.packs_fit() {
         issues.push(format!(
-            "pack set ({}) exceeds this instance's cache limit ({}); objects are read from the store by range, clones must use bundle-uri",
+            "pack set ({}) exceeds this instance's cache limit ({}); objects are read from the store by range",
             walgit_wal::remote::human_bytes(manifest.packs.iter().map(|p| p.pack_size + p.idx_size).sum()),
             walgit_wal::remote::human_bytes(state.cfg.cache.max_bytes.as_u64())
         ));
@@ -713,44 +660,16 @@ async fn overview(
             ),
         });
     }
-    let has_bitmap_base = manifest.packs.iter().any(|p| p.tier == 2 && p.has_bitmap);
     let fresh = manifest.packs.iter().filter(|p| p.tier == 0).count();
-    let ecfg = handle.effective_config();
-    let compaction_on = ecfg.compaction.enabled && state.cfg.has_role(walgit_config::Role::Compact);
-    let live_bytes: u64 = manifest
-        .packs
-        .iter()
-        .map(|p| p.pack_size + p.idx_size)
-        .sum();
-    let weekly = ecfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.kind == walgit_config::BundleKind::Full)
-        .map(|s| s.name.clone());
-    if !manifest.packs.is_empty() && !has_bitmap_base {
-        suggestions.push(Suggestion {
-            op: "compact",
-            params: Some("base=1".into()),
-            reason: "no bitmap'd base pack: clones compute reachability on every instance".into(),
-            auto: match (&weekly, compaction_on) {
-                (Some(w), true) => Some(format!(
-                    "at the next `{w}` slot, on a maintainer whose capacity holds the pack set ({})",
-                    walgit_wal::remote::human_bytes(live_bytes)
-                )),
-                (Some(_), false) | (None, _) => None,
-                },
-        });
-    } else if fresh >= ecfg.compaction.trigger_packs.max(2) {
+    let ecfg = handle.validated_effective_config().map_err(wal_err)?;
+    let maintenance_on = ecfg.packs.enabled && state.cfg.has_role(walgit_config::Role::Compact);
+    if fresh >= ecfg.packs.fold_needs_at_least_packs {
         suggestions.push(Suggestion {
             op: "compact",
             params: None,
-            reason: format!("{fresh} fresh push packs waiting to be folded"),
-            auto: compaction_on.then(|| {
-                format!(
-                    "geometric fold on the maintainer's next pass (trigger: {} packs / {})",
-                    ecfg.compaction.trigger_packs, ecfg.compaction.trigger_bytes
-                )
+            reason: format!("{fresh} fresh packs available for maintenance"),
+            auto: maintenance_on.then(|| {
+                "the maintainer evaluates size and age within each compatible pack family".into()
             }),
         });
     }
@@ -774,14 +693,6 @@ async fn overview(
                 )),
             });
         }
-        if ecfg.bundles.enabled && bundles.is_empty() {
-            suggestions.push(Suggestion {
-                op: "bundle",
-                params: None,
-                reason: "no bundle-uri bundle published: initial clones go through upload-pack".into(),
-                auto: weekly.as_ref().map(|w| format!("the first `{w}` slot at or after the repository's first WAL state, on the maintainer's next pass")),
-            });
-        }
     }
     // The audit verdict lives in the store (`fsck.pb`, written by whichever maintainer ran it),
     // not in this instance's task memory.
@@ -858,80 +769,15 @@ async fn overview(
     let ops = OpsInfo {
         available: crate::ops::OPS.to_vec(),
         recent: state.registry.tasks().recent(&id.to_string()),
-        bundle_strategies: state
-            .cfg
-            .bundles
-            .strategy
-            .iter()
-            .map(|s| s.name.clone())
-            .collect(),
     };
     let clone = CloneInfo {
         manual: recipes.manual_clone.clone(),
         plain: recipes.plain_clone.clone(),
     };
-    // Slot table + maintainers (best effort; never fails the overview).
-    let bundle_plan = {
-        let ctx = walgit_bundle::slots::PlanContext {
-            first_state: handle.first_state_time(),
-            can_full: true,
-            can_incremental: true,
-            wrong_host_reason: None,
-        };
-        let slots = match state
-            .bundles
-            .plan(&id, std::time::SystemTime::now(), ctx)
-            .await
-        {
-            Ok(rows) => rows
-                .into_iter()
-                .map(|r| {
-                    use walgit_bundle::slots::SlotStatus as S;
-                    let (status, detail, bundle_id) = match r.status {
-                        S::Built { id, size, seq } => {
-                            ("built", format!("{size} bytes, seq {seq}"), Some(id))
-                        }
-                        S::Missing => ("missing", String::new(), None),
-                        S::Pending => (
-                            "pending",
-                            "slot just fired; built or settled after the 2-minute close grace"
-                                .into(),
-                            None,
-                        ),
-                        S::Blocked(w) => ("blocked", w, None),
-                        S::Unavailable => ("unavailable", "no WAL state at that time".into(), None),
-                        S::TooSmall { commits, min } => (
-                            "too-small",
-                            format!(
-                                "{commits} commits since base (min {min}); next slot catches up"
-                            ),
-                            None,
-                        ),
-                        S::Skipped { reason } => ("skipped", reason, None),
-                        S::WrongHost(w) => ("wrong-host", w, None),
-                    };
-                    SlotInfo {
-                        strategy: r.strategy,
-                        kind: format!("{:?}", r.kind).to_lowercase(),
-                        slot: r.slot,
-                        status: status.into(),
-                        detail,
-                        bundle_id,
-                    }
-                })
-                .collect(),
-            Err(_) => Vec::new(),
-        };
+    let maintenance = {
         let hbs_all = crate::maintain::heartbeats(&state)
             .await
             .unwrap_or_default();
-        let upcoming = crate::maintain::upcoming(
-            &handle,
-            &handle.effective_config(),
-            &hbs_all,
-            std::time::SystemTime::now(),
-        )
-        .await;
         let maintainers: Vec<MaintainerInfo> = match Ok::<_, anyhow::Error>(hbs_all) {
             Ok(hbs) => hbs
                 .into_iter()
@@ -960,9 +806,7 @@ async fn overview(
             Err(_) => Vec::new(),
         };
         let orphaned = !maintainers.iter().any(|m| m.alive);
-        BundlePlanInfo {
-            slots,
-            upcoming,
+        MaintenanceInfo {
             maintainers,
             orphaned,
         }
@@ -997,9 +841,7 @@ async fn overview(
                 .collect(),
             tail_entries: entries.len(),
             entries: entries.len(),
-            checkpoint,
             packset,
-            advertised_bundle_uri: None,
             last_push,
         },
         local: LocalInfo {
@@ -1016,8 +858,7 @@ async fn overview(
             live_bytes: packs_bytes,
             pushes: push_count,
         },
-        bundles,
-        bundle_plan,
+        maintenance,
         compactions,
         node: {
             let mut m = serde_json::Map::new();
@@ -1051,13 +892,6 @@ async fn ops_list(
     let body = OpsInfo {
         available: crate::ops::OPS.to_vec(),
         recent: state.registry.tasks().recent(&id.to_string()),
-        bundle_strategies: state
-            .cfg
-            .bundles
-            .strategy
-            .iter()
-            .map(|s| s.name.clone())
-            .collect(),
     };
     Ok((
         [
@@ -1097,7 +931,7 @@ async fn ops_start(
 }
 
 /// `GET …/tasks` — running + recent background tasks of this repo on this
-/// instance (materialize, remote-index, fsck, compact, bundle, ...). The UI
+/// instance (materialize, remote-index, fsck, compact, ...). The UI
 /// polls this to show what is happening to a repo.
 async fn tasks_list(
     State(state): State<Arc<AppState>>,
@@ -1153,113 +987,6 @@ async fn task_stream(
     Ok(crate::sse::task_stream(task))
 }
 
-async fn checkpoint_info(
-    handle: &walgit_wal::RepoHandle,
-    manifest: &walgit_proto::v1::Manifest,
-    _base_url: &str,
-) -> Result<Option<BundleInfo>, ApiError> {
-    let Some(reference) = &manifest.checkpoint else {
-        return Ok(None);
-    };
-    let (size, created, creator) = match handle
-        .store()
-        .get(&reference.key, GetOptions::default())
-        .await
-    {
-        Ok(GetResult::Object { meta, body }) => {
-            let bytes = walgit_store::util::collect(body, meta.size as usize)
-                .await
-                .map_err(|e| ApiError::Internal(e.to_string()))?;
-            let checkpoint = Checkpoint::decode(bytes.as_ref())
-                .map_err(|e| ApiError::Internal(e.to_string()))?;
-            (
-                meta.size,
-                checkpoint
-                    .created_at
-                    .as_ref()
-                    .map(timestamp)
-                    .unwrap_or_default(),
-                checkpoint.writer,
-            )
-        }
-        Ok(GetResult::NotModified { .. }) | Err(walgit_store::StoreError::NotFound { .. }) => {
-            (0, String::new(), String::new())
-        }
-        Err(error) => return Err(ApiError::Internal(error.to_string())),
-    };
-    Ok(Some(BundleInfo {
-        sha: reference.key.clone(),
-        size,
-        at_seq: reference.seq,
-        created,
-        creator,
-        // Checkpoints are store objects (not served over HTTP); show the key.
-        uri: format!("gs://…/{}", reference.key),
-        strategy: String::new(),
-        kind: String::new(),
-        base_id: String::new(),
-        creation_token: 0,
-        filter: String::new(),
-        tips: Vec::new(),
-    }))
-}
-
-async fn bundle_infos(
-    state: &AppState,
-    id: &walgit_git::RepoId,
-    base_url: &str,
-) -> Result<Vec<BundleInfo>, ApiError> {
-    let list = state
-        .bundles
-        .list(id)
-        .await
-        .map_err(|e| ApiError::Internal(e.to_string()))?;
-    let Some(list) = list else {
-        return Ok(Vec::new());
-    };
-    // Exactly the URIs the bundle-uri advertisement hands to git (one code
-    // path: walgit_bundle::render::bundle_uri), so the WAL page never shows a
-    // link that differs from what clients download.
-    let handle = state.registry.open(id).await.map_err(wal_err)?;
-    let mut out = Vec::with_capacity(list.bundles.len());
-    for bundle in list.bundles {
-        let uri = walgit_bundle::render::bundle_uri(
-            &bundle,
-            id.owner(),
-            id.name(),
-            base_url,
-            state.cfg.bundles.serve_via,
-            handle.store(),
-            state.cfg.bundles.signed_url_ttl,
-        )
-        .await
-        .map_err(|e| ApiError::Internal(e.to_string()))?;
-        out.push(BundleInfo {
-            sha: bundle.id.clone(),
-            size: bundle.size,
-            at_seq: bundle.seq,
-            created: bundle
-                .created_at
-                .as_ref()
-                .map(timestamp)
-                .unwrap_or_default(),
-            creator: String::new(),
-            uri,
-            strategy: bundle.strategy.clone(),
-            kind: bundle.kind.clone(),
-            base_id: bundle.base_id.clone(),
-            creation_token: bundle.creation_token,
-            filter: bundle.filter.clone(),
-            tips: bundle
-                .tips
-                .iter()
-                .map(|t| (t.name.clone(), t.oid.clone()))
-                .collect(),
-        });
-    }
-    Ok(out)
-}
-
 fn timestamp(value: &prost_types::Timestamp) -> String {
     chrono::DateTime::<chrono::Utc>::from_timestamp(value.seconds, value.nanos as u32)
         .map(|date| date.to_rfc3339())
diff --git a/crates/walgit-server/tests/api_v1.rs b/crates/walgit-server/tests/api_v1.rs
index 89f2f0e..5708254 100644
--- a/crates/walgit-server/tests/api_v1.rs
+++ b/crates/walgit-server/tests/api_v1.rs
@@ -424,7 +424,7 @@ async fn d26_prefix_form_matches_v1_alias() -> TestResult {
             "{}/t/pfx/api/settings?message=via+prefix",
             server.base_url
         ))
-        .body("[bundles]\nmin_commits = 7\n")
+        .body("[packs]\nfold_when_fresh_packs_reach = 7\n")
         .send()
         .await?;
     assert_eq!(r.status(), 200, "{}", r.text().await?);
@@ -442,7 +442,7 @@ async fn d26_prefix_form_matches_v1_alias() -> TestResult {
         .await?
         .json()
         .await?;
-    assert_eq!(d["bundles"]["min_commits"], 7);
+    assert_eq!(d["packs"]["fold_when_fresh_packs_reach"], 7);
     let p: serde_json::Value = c
         .get(format!("{}/t/pfx/api/policy", server.base_url))
         .send()
@@ -565,7 +565,7 @@ async fn repository_delete_requires_admin() -> TestResult {
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn policy_and_settings_writes_require_admin() -> TestResult {
     const POLICY: &str = r#"{"version":1,"groups":[],"rules":[]}"#;
-    const SETTINGS: &str = "[bundles]\nmin_commits = 3\n";
+    const SETTINGS: &str = "[packs]\nfold_when_fresh_packs_reach = 3\n";
     let server = Server::start_with_tweak(|c| {
         c.server.auth.mode = walgit_config::AuthMode::Token;
         c.server.auth.anonymous_read = false;
diff --git a/crates/walgit-server/tests/e2e.rs b/crates/walgit-server/tests/e2e.rs
index 7c67cb8..e37eea2 100644
--- a/crates/walgit-server/tests/e2e.rs
+++ b/crates/walgit-server/tests/e2e.rs
@@ -30,6 +30,7 @@ async fn info_refs_v2_advertises_capabilities() -> TestResult {
     assert!(out.contains("version 2"));
     assert!(out.contains("ls-refs=unborn"));
     assert!(out.contains("fetch=shallow wait-for-done"));
+    assert!(!out.contains("bundle-uri"), "{out}");
     Ok(())
 }
 
@@ -66,6 +67,25 @@ async fn push_clone_roundtrip_v2() -> TestResult {
     let src_head = git_in(&src, &["rev-parse", "main"])?;
     let cl_head = git_in(clone_dir.path(), &["rev-parse", "main"])?;
     assert_eq!(src_head.trim(), cl_head.trim());
+    // Ordinary Git transfer remains complete after removing the bundle runtime.
+    for suffix in [
+        "bundles/list",
+        "bundles/catchup",
+        "bundles/weekly/example.bundle",
+    ] {
+        assert_eq!(server.get_status(&format!("/t/r.git/{suffix}")).await?, 404);
+    }
+    let command = "command=bundle-uri\n";
+    let response = reqwest::Client::new()
+        .post(format!("{}/git-upload-pack", server.repo_url("t", "r")))
+        .header("Git-Protocol", "version=2")
+        .header("Content-Type", "application/x-git-upload-pack-request")
+        .body(format!("{:04x}{command}00010000", command.len() + 4))
+        .send()
+        .await?;
+    assert_eq!(response.status(), 400);
+    assert!(response.text().await?.contains("unknown v2 command"));
+
     Ok(())
 }
 
@@ -811,64 +831,6 @@ async fn sha256_repo_roundtrip() -> TestResult {
     Ok(())
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn bundle_uri_clone_fetches_server_bundle() -> TestResult {
-    let server = Server::start().await?;
-    server.put_repo("t", "bundled").await?;
-    let src = TestRepo::synthetic(3, 2)?;
-    git_in(&src, &["branch", "-M", "main"])?;
-    git_in(
-        &src,
-        &["remote", "add", "origin", &server.repo_url("t", "bundled")],
-    )?;
-    git_in(&src, &["push", "origin", "main"])?;
-    server.build_bundle("t", "bundled", "weekly").await?;
-
-    // The WAL page shows exactly the URI the bundle list advertises, and it downloads.
-    let bundle_list = format!("{}/t/bundled/bundles/list", server.base_url);
-    let list_text = reqwest::get(&bundle_list).await?.text().await?;
-    let overview: serde_json::Value =
-        reqwest::get(format!("{}/t/bundled/api/overview", server.base_url))
-            .await?
-            .json()
-            .await?;
-    let ui_uri = overview["bundles"][0]["uri"]
-        .as_str()
-        .expect("overview bundle uri")
-        .to_string();
-    assert!(
-        list_text.contains(&format!("uri = {ui_uri}")),
-        "overview uri {ui_uri} not in list:\n{list_text}"
-    );
-    let head = reqwest::Client::new().head(&ui_uri).send().await?;
-    assert_eq!(
-        head.status(),
-        200,
-        "overview bundle uri must be downloadable"
-    );
-
-    let clone_dir = tempfile::tempdir()?;
-    git(
-        &[
-            "-c",
-            "transfer.bundleURI=true",
-            "clone",
-            "--branch",
-            "main",
-            "--bundle-uri",
-            &bundle_list,
-            &server.repo_url("t", "bundled"),
-            clone_dir.path().to_str().unwrap(),
-        ],
-        clone_dir.path().parent().unwrap(),
-    )?;
-    assert_eq!(
-        git_in(clone_dir.path(), &["rev-parse", "main"])?.trim(),
-        git_in(&src, &["rev-parse", "main"])?.trim()
-    );
-    Ok(())
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn lfs_roundtrip_when_available() -> TestResult {
     if !git_lfs_present() {
@@ -970,17 +932,6 @@ async fn lfs_roundtrip_when_available() -> TestResult {
     Ok(())
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn bundle_endpoints_when_landed() -> TestResult {
-    let server = Server::start().await?;
-    server.put_repo("t", "r").await?;
-    // The bundle list endpoint should respond (404 no-bundles is acceptable
-    // until the bundler has produced entries; never a 5xx).
-    let status = server.get_status("/t/r.git/bundles/list").await?;
-    assert!(status.as_u16() < 500, "bundle list returned {status}");
-    Ok(())
-}
-
 fn git_lfs_present() -> bool {
     Command::new("git")
         .args(["lfs", "version"])
@@ -1004,11 +955,11 @@ fn git_supports_sha256() -> bool {
 }
 
 /// A front whose `cache.max_bytes` cannot hold a repository's pack set must
-/// still answer every refs-level request (ls-remote v0/v2, bundle list, web
+/// still answer every refs-level request (ls-remote v0/v2, web
 /// refs) from the WAL ref snapshot, refuse object work with a readable
-/// pkt-line ERR pointing at bundle-uri, and never pull the packs.
+/// pkt-line ERR explaining the capacity limit, and never pull the packs.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
+async fn huge_repo_front_serves_refs_without_packs() -> TestResult {
     let big = Server::start().await?;
     big.put_repo("t", "huge").await?;
     let src = TestRepo::synthetic(4, 3)?;
@@ -1019,7 +970,6 @@ async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
         &["remote", "add", "origin", &big.repo_url("t", "huge")],
     )?;
     git_in(&src, &["push", "origin", "main", "v1"])?;
-    big.build_bundle("t", "huge", "weekly").await?;
 
     // Second front: 1 byte of pack cache.
     let small = big
@@ -1048,10 +998,7 @@ async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
             "peeled tag from snapshot (v{proto}): {out}"
         );
     }
-    // Bundle list + web refs work.
-    let list = reqwest::get(format!("{}/t/huge/bundles/list", small.base_url)).await?;
-    assert_eq!(list.status(), 200);
-    assert!(list.text().await?.contains("version = 1"));
+    // Web refs work without object materialization.
     let refs = reqwest::get(format!("{}/t/huge/api/refs", small.base_url)).await?;
     assert_eq!(refs.status(), 200);
     let refs: serde_json::Value = refs.json().await?;
@@ -1059,24 +1006,14 @@ async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
     let resolved = reqwest::get(format!("{}/t/huge/api/resolve/main", small.base_url)).await?;
     assert_eq!(resolved.status(), 200);
 
-    // Object work is refused with the bundle-uri hint, not a crash/OOM.
+    // Object work is refused with a capacity explanation.
     let clone_dir = tempfile::tempdir()?;
     let err = git(
-        &[
-            "-c",
-            "transfer.bundleURI=false",
-            "clone",
-            &url,
-            clone_dir.path().to_str().unwrap(),
-        ],
+        &["clone", &url, clone_dir.path().to_str().unwrap()],
         clone_dir.path().parent().unwrap(),
     )
     .unwrap_err()
     .to_string();
-    assert!(
-        err.contains("transfer.bundleURI"),
-        "clone error should explain bundle-uri: {err}"
-    );
     assert!(err.contains("larger than this instance"), "{err}");
     // The small front never downloaded the pack set.
     assert!(
@@ -1084,15 +1021,10 @@ async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
         "small front must not materialize packs"
     );
 
-    // And with bundle-uri the clone gets its objects from the bundle; the final
-    // fetch against the small front is the part that still needs objects (today it
-    // fails the same way), so clone via the big front for the bytes and check the
-    // small front only rendered refs.
+    // A capacity-suitable front still supports an ordinary clone.
     let clone2 = tempfile::tempdir()?;
     git(
         &[
-            "-c",
-            "transfer.bundleURI=true",
             "clone",
             &big.repo_url("t", "huge"),
             clone2.path().to_str().unwrap(),
@@ -1104,7 +1036,7 @@ async fn huge_repo_front_serves_refs_and_bundles_without_packs() -> TestResult {
 }
 
 /// The server narrates a v2 fetch over sideband (band 2 → `remote: * …`):
-/// auth, WAL seq, bundle facts, local copy state — before upload-pack's own
+/// auth, WAL seq, local copy state — before upload-pack's own
 /// progress. Requires sideband-all (advertised with the git engine).
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fetch_is_narrated_over_sideband() -> TestResult {
@@ -1151,7 +1083,7 @@ async fn fetch_is_narrated_over_sideband() -> TestResult {
     println!("{stderr}");
     // `no-progress` is honoured: git sends it for its own lazy promisor fetches (blobs during a
     // sparse checkout of a blobless clone) and for any non-tty fetch without --progress; those
-    // must not be narrated — a large repository clone whose bundles cover the tips therefore shows no
+    // must not be narrated — an up-to-date client therefore sees no
     // `remote: *` lines at all (2026-08-22 gate 4), by design, not because the SSD host is silent.
     let quiet = tempfile::tempdir()?;
     let out = std::process::Command::new("git")
@@ -1177,7 +1109,7 @@ async fn fetch_is_narrated_over_sideband() -> TestResult {
 /// fetch` anyway: the base is remote-served (commit-graph layer local, data by
 /// range read through the remote reader), recent packs are local, and the gix
 /// engine enumerates by tree diff against the client's haves. The client
-/// cloned from a big front (stand-in for bundle-uri) and fetches a later push
+/// cloned from a big front and fetches a later push
 /// from the small one.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
@@ -1210,7 +1142,6 @@ async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
     let log = |line: String| println!("compact: {line}");
     let out = walgit_server::ops::compact_repo(
         &handle,
-        &big.state.cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: true,
@@ -1220,16 +1151,20 @@ async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
     .await?;
     println!("{}", out.summary());
     let m = handle.manifest();
-    let base = m.packs.iter().find(|p| p.tier == 2).expect("a tier-2 base");
+    let base = m
+        .packs
+        .iter()
+        .find(|p| p.tier == 2 && p.has_commit_graph)
+        .expect("a frozen pack carrying the commit-graph layer");
     assert!(
         base.has_commit_graph,
         "base carries a commit-graph layer: {base:?}"
     );
+    let remote_pack = m.packs.iter().max_by_key(|p| p.pack_size).unwrap();
+    assert_eq!(remote_pack.kind, walgit_proto::v1::PackKind::Blobs as i32);
     let base_tip = git_in(&src, &["rev-parse", "main"])?.trim().to_string();
 
-    // Weekly full bundle at the base (what the VM job's compose would give).
-    big.build_bundle("t", "rbase", "weekly").await?;
-    // Client: full clone from the big front (what bundle-uri would give it).
+    // Client: full clone from the big front.
     let clone = tempfile::tempdir()?;
     git(
         &[
@@ -1254,7 +1189,9 @@ async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
 
     // Small front: cannot hold the base, no mount → remote-served.
     let small = big
-        .start_sibling_with(|c| c.cache.max_bytes = bytesize::ByteSize::b(base.pack_size / 2))
+        .start_sibling_with(|c| {
+            c.cache.max_bytes = bytesize::ByteSize::b(remote_pack.pack_size / 2);
+        })
         .await?;
     let url = small.repo_url("t", "rbase");
     git_in(clone.path(), &["remote", "set-url", "origin", &url])?;
@@ -1284,45 +1221,23 @@ async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
     assert!(stderr.contains("read from the bucket by range"), "{stderr}");
     // The small front never materialized the base pack.
     let sh = small.state.registry.open(&id).await?;
-    assert_eq!(sh.remote_served(), vec![base.checksum.clone()]);
-    assert!(
-        !sh.local()
-            .pack_path(&gix_hash::ObjectId::from_hex(base.checksum.as_bytes())?)
-            .exists()
-    );
-
-    // Incremental bundle built on the small front with the gix engine (the
-    // weekly full one exists from the big front): verifies and applies on a
-    // clone that has the base.
-    let entry = small.state.bundles.build(&id, "daily").await?;
-    assert_eq!(entry.kind, "incremental");
-    let bundle_bytes = reqwest::get(format!(
-        "{}/t/rbase.git/bundles/{}",
-        small.base_url,
-        entry.key.trim_start_matches("bundles/")
-    ))
-    .await?;
-    assert_eq!(bundle_bytes.status(), 200, "{}", entry.key);
-    let bundle_path = clone.path().join("daily.bundle");
-    std::fs::write(&bundle_path, bundle_bytes.bytes().await?)?;
-    let verify = std::process::Command::new("git")
-        .current_dir(clone.path())
-        .args(["bundle", "verify", bundle_path.to_str().unwrap()])
-        .output()?;
-    assert!(
-        verify.status.success(),
-        "{}",
-        String::from_utf8_lossy(&verify.stderr)
-    );
-    let out = std::process::Command::new("git")
-        .current_dir(clone.path())
-        .args(["bundle", "list-heads", bundle_path.to_str().unwrap()])
-        .output()?;
-    assert!(
-        String::from_utf8_lossy(&out.stdout).contains(&new_tip),
-        "{}",
-        String::from_utf8_lossy(&out.stdout)
-    );
+    let mut expected_remote: Vec<_> = m
+        .packs
+        .iter()
+        .filter(|p| p.tier == 2)
+        .map(|p| p.checksum.clone())
+        .collect();
+    expected_remote.sort();
+    let mut actual_remote = sh.remote_served();
+    actual_remote.sort();
+    assert_eq!(actual_remote, expected_remote);
+    for checksum in &expected_remote {
+        assert!(
+            !sh.local()
+                .pack_path(&gix_hash::ObjectId::from_hex(checksum.as_bytes())?)
+                .exists()
+        );
+    }
 
     // Protocol v0 is refused with a readable explanation (stock git cannot
     // read a remote-served base).
@@ -1339,103 +1254,6 @@ async fn fetch_from_front_that_serves_the_base_remotely() -> TestResult {
     Ok(())
 }
 
-/// `bundles.require`: on a listed repository a fetch with zero haves (a clone
-/// that skipped bundle-uri) is refused with the exact fix — v2 (band 3 when the
-/// client accepts sideband, pkt ERR otherwise) and v0 — while clones through
-/// bundle-uri and ordinary fetches with haves proceed.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn bundles_require_refuses_zero_have_fetches_with_the_fix() -> TestResult {
-    let server = Server::start_with_tweak(|c| c.bundles.require = vec!["t/*".into()]).await?;
-    server.put_repo("t", "req").await?;
-    let src = TestRepo::synthetic(3, 2)?;
-    git_in(
-        &src,
-        &["remote", "add", "origin", &server.repo_url("t", "req")],
-    )?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    server.build_bundle("t", "req", "weekly").await?;
-    let url = server.repo_url("t", "req");
-
-    for proto in ["2", "0"] {
-        let dir = tempfile::tempdir()?;
-        let out = std::process::Command::new("git")
-            .args([
-                "-c",
-                &format!("protocol.version={proto}"),
-                "-c",
-                "transfer.bundleURI=false",
-                "clone",
-                &url,
-                dir.path().to_str().unwrap(),
-            ])
-            .output()?;
-        let stderr = String::from_utf8_lossy(&out.stderr);
-        assert!(
-            !out.status.success(),
-            "v{proto} clone without bundle-uri must be refused:\n{stderr}"
-        );
-        assert!(
-            stderr.contains("transfer.bundleURI true"),
-            "v{proto} fix missing:\n{stderr}"
-        );
-        assert!(stderr.contains("served from static bundles"), "{stderr}");
-    }
-
-    // D16: bounded zero-have fetches (CI's shallow / filtered clones) are served.
-    for args in [
-        vec!["--depth", "1"],
-        vec!["--filter=blob:none"],
-        vec!["--depth", "1", "--filter=blob:none", "--single-branch"],
-    ] {
-        let d = tempfile::tempdir()?;
-        let mut cmd = vec!["-c", "transfer.bundleURI=false", "clone", "-q"];
-        cmd.extend(args.iter().copied());
-        cmd.push(&url);
-        cmd.push(d.path().to_str().unwrap());
-        let out = std::process::Command::new("git").args(&cmd).output()?;
-        assert!(
-            out.status.success(),
-            "{args:?}: {}",
-            String::from_utf8_lossy(&out.stderr)
-        );
-        assert_eq!(
-            git_in(d.path(), &["rev-parse", "HEAD"])?.trim(),
-            git_in(&src, &["rev-parse", "main"])?.trim()
-        );
-    }
-
-    // Through bundle-uri: history from the bundle, the server fills the gap.
-    let dir = tempfile::tempdir()?;
-    let out = std::process::Command::new("git")
-        .args([
-            "-c",
-            "transfer.bundleURI=true",
-            "clone",
-            &url,
-            dir.path().to_str().unwrap(),
-        ])
-        .output()?;
-    assert!(
-        out.status.success(),
-        "{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    let head = git_in(&src, &["rev-parse", "main"])?;
-    assert_eq!(git_in(dir.path(), &["rev-parse", "HEAD"])?, head);
-
-    // A later fetch (haves present) works.
-    std::fs::write(src.join("more.txt"), "more\n")?;
-    git_in(&src, &["add", "more.txt"])?;
-    git_in(&src, &["commit", "-q", "-m", "more"])?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    git_in(dir.path(), &["fetch", "-q", "origin"])?;
-    assert_eq!(
-        git_in(dir.path(), &["rev-parse", "origin/main"])?,
-        git_in(&src, &["rev-parse", "main"])?
-    );
-    Ok(())
-}
-
 /// `git.max_wants`: a blobless clone that checks out HEAD asks for every blob of the tree in one lazy
 /// fetch (carrying `no-progress`, so nothing narrated there is seen). Above the bound the server
 /// refuses that fetch with the fix (`--sparse` / `--no-checkout`, the recipes) before any pack work;
@@ -1457,8 +1275,6 @@ async fn max_wants_refuses_the_blobless_checkout_storm_with_the_fix() -> TestRes
     let dir = tempfile::tempdir()?;
     let out = std::process::Command::new("git")
         .args([
-            "-c",
-            "transfer.bundleURI=false",
             "clone",
             "--filter=blob:none",
             "--progress",
@@ -1476,7 +1292,7 @@ async fn max_wants_refuses_the_blobless_checkout_storm_with_the_fix() -> TestRes
         "{stderr}"
     );
     assert!(
-        stderr.contains("--filter=blob:none --sparse --bundle-uri="),
+        stderr.contains("--filter=blob:none --sparse"),
         "the fix is in the error:\n{stderr}"
     );
     // The initial (commit/tree) fetch narrated the heads-up on band 2 before anything went wrong.
@@ -1493,8 +1309,6 @@ async fn max_wants_refuses_the_blobless_checkout_storm_with_the_fix() -> TestRes
     let dir = tempfile::tempdir()?;
     let out = std::process::Command::new("git")
         .args([
-            "-c",
-            "transfer.bundleURI=false",
             "clone",
             "-q",
             "--filter=blob:none",
@@ -1523,120 +1337,6 @@ async fn max_wants_refuses_the_blobless_checkout_storm_with_the_fix() -> TestRes
     Ok(())
 }
 
-/// D17 amendment: a principal that fetched the bundle list within the hour
-/// TRIED bundle-uri (its zero-have fetch is a bundle download that failed —
-/// git never retries one) and gets ONE upload-pack full clone per 6 h, with a
-/// loud band-2 warning; the next one is refused with the truthful message; a
-/// principal that never fetched the list is refused as before.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn bundles_require_allows_one_upload_pack_fallback_after_a_failed_bundle_attempt()
--> TestResult {
-    let server = Server::start_with_tweak(|c| {
-        c.bundles.require = vec!["t/*".into()];
-        c.server.auth.mode = walgit_config::AuthMode::Token;
-        c.server.auth.anonymous_read = false;
-        c.server.auth.tokens = vec![
-            walgit_config::StaticToken {
-                principal: "dev@example.com".into(),
-                token: "dev".into(),
-                token_env: None,
-                write: true,
-                admin: false,
-            },
-            walgit_config::StaticToken {
-                principal: "other@example.com".into(),
-                token: "other".into(),
-                token_env: None,
-                write: true,
-                admin: false,
-            },
-        ];
-    })
-    .await?;
-    let r = reqwest::Client::new()
-        .put(format!("{}/t/fb.git", server.base_url))
-        .header("Authorization", "Bearer dev")
-        .send()
-        .await?;
-    assert!(r.status().is_success(), "{}", r.status());
-    let src = tempfile::tempdir()?;
-    git(&["init", "-q", "-b", "main", "."], src.path())?;
-    git(
-        &[
-            "-c",
-            "user.email=t@t",
-            "-c",
-            "user.name=T",
-            "commit",
-            "-q",
-            "--allow-empty",
-            "-m",
-            "one",
-        ],
-        src.path(),
-    )?;
-    let url = server.repo_url("t", "fb");
-    git(
-        &[
-            "-c",
-            "http.extraHeader=Authorization: Bearer dev",
-            "push",
-            "-q",
-            &url,
-            "main",
-        ],
-        src.path(),
-    )?;
-    let clone = |token: &str| {
-        let d = tempfile::tempdir().unwrap();
-        let out = std::process::Command::new("git")
-            .args([
-                "-c",
-                &format!("http.extraHeader=Authorization: Bearer {token}"),
-                "-c",
-                "transfer.bundleURI=false",
-                "clone",
-                "--progress",
-                &url,
-                d.path().to_str().unwrap(),
-            ])
-            .output()
-            .unwrap();
-        (
-            out.status.success(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    };
-    // Never fetched the list → refused.
-    let (ok, err) = clone("dev");
-    assert!(!ok && err.contains("served from static bundles"), "{err}");
-    // "Tried" bundle-uri: fetched the list.
-    let list = reqwest::Client::new()
-        .get(format!("{}/t/fb.git/bundles/list", server.base_url))
-        .header("Authorization", "Bearer dev")
-        .send()
-        .await?;
-    assert!(
-        list.status() == 200 || list.status() == 404,
-        "{}",
-        list.status()
-    );
-    // One fallback, loudly.
-    let (ok, err) = clone("dev");
-    assert!(ok, "fallback clone must succeed:\n{err}");
-    assert!(
-        err.contains("WARNING") && err.contains("upload-pack ONCE"),
-        "{err}"
-    );
-    // The second within 6 h: refused, and the message says so.
-    let (ok, err) = clone("dev");
-    assert!(!ok && err.contains("you may have used it"), "{err}");
-    // Another principal that never tried: refused.
-    let (ok, err) = clone("other");
-    assert!(!ok && err.contains("served from static bundles"), "{err}");
-    Ok(())
-}
-
 /// A push is narrated on band 2 (`remote: * …`) from the first moment — the
 /// server never lets the connection go silent while it syncs/unpacks — and
 /// still ends with a clean report-status.
@@ -1832,7 +1532,7 @@ async fn history_pack_install_does_not_stall_the_runtime() -> TestResult {
         std::fs::write(
             shim.path().join("git"),
             format!(
-                "#!/bin/sh\nif [ \"$1\" = multi-pack-index ]; then sleep 3; fi\nexec {real_git} \"$@\"\n"
+                "#!/bin/sh\nfor arg in \"$@\"; do\n  if [ \"$arg\" = multi-pack-index ]; then sleep 3; break; fi\ndone\nexec {real_git} \"$@\"\n"
             ),
         )?;
         std::fs::set_permissions(
@@ -1875,7 +1575,6 @@ async fn history_pack_install_does_not_stall_the_runtime() -> TestResult {
     let log = |line: String| println!("compact: {line}");
     walgit_server::ops::compact_repo(
         &h,
-        &big.state.cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: true,
@@ -2052,81 +1751,6 @@ async fn blocking_work_in_the_install_path_does_not_stall_requests() -> TestResu
     Ok(())
 }
 
-/// Signed bundle URLs that cannot be produced because store signing is
-/// unavailable or denied must fall back to proxy URIs — the
-/// static list, the v2 `bundle-uri` command and a clone through bundle-uri all
-/// work — and the fetch narrates each advertised bundle by relative path.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn signed_url_failure_falls_back_to_proxy_uris_and_bundles_are_narrated() -> TestResult {
-    let server = Server::start_with_store_and_tweak(
-        {
-            let mut s = walgit_store::memory::MemoryStore::new();
-            s.signing_fails = true;
-            std::sync::Arc::new(s)
-        },
-        |c| c.bundles.signed_url_for = vec!["t/*".into()],
-    )
-    .await?;
-    server.put_repo("t", "sig").await?;
-    let src = TestRepo::synthetic(3, 2)?;
-    git_in(
-        &src,
-        &["remote", "add", "origin", &server.repo_url("t", "sig")],
-    )?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    server.build_bundle("t", "sig", "weekly").await?;
-
-    // Static list: 200 with proxy URIs, never a 500.
-    let list = server.get_text("/t/sig.git/bundles/list", &[]).await?;
-    assert!(
-        list.contains(&format!("uri = {}/t/sig/bundles/weekly/", server.base_url)),
-        "{list}"
-    );
-
-    // Clone through bundle-uri (v2 command + fetch of the bundle), narrated.
-    let dir = tempfile::tempdir()?;
-    let out = std::process::Command::new("git")
-        .args([
-            "-c",
-            "protocol.version=2",
-            "-c",
-            "transfer.bundleURI=true",
-            "clone",
-            "--progress",
-            &server.repo_url("t", "sig"),
-            dir.path().to_str().unwrap(),
-        ])
-        .output()?;
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert!(out.status.success(), "{stderr}");
-    assert_eq!(
-        git_in(dir.path(), &["rev-parse", "HEAD"])?,
-        git_in(&src, &["rev-parse", "main"])?
-    );
-    // A fetch with work narrates the bundles from the client's point of view: the list's shape per
-    // strategy, and which bundles THIS git applied (its haves are their tips) with their bytes.
-    std::fs::write(src.join("n.txt"), "n\n")?;
-    git_in(&src, &["add", "n.txt"])?;
-    git_in(&src, &["commit", "-q", "-m", "n"])?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    let out = std::process::Command::new("git")
-        .args(["-c", "protocol.version=2", "fetch", "--progress", "origin"])
-        .current_dir(dir.path())
-        .output()?;
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert!(out.status.success(), "{stderr}");
-    assert!(
-        stderr.contains("* bundle-uri: 1 listed — 1 weekly ("),
-        "list shape missing:\n{stderr}"
-    );
-    assert!(
-        stderr.contains("* bundle-uri: your git applied 1 bundle(s) = ")
-            && stderr.contains("(weekly) — history as of "),
-        "applied-bundles line missing:\n{stderr}"
-    );
-    Ok(())
-}
-
 /// D24: per-repo settings over HTTP — PUT validates (400 with the reason,
 /// nothing published), GET returns the document + revision, `effective` is
 /// the host config ⊕ settings, a sibling instance sees it on its next refs
@@ -2154,16 +1778,21 @@ async fn repo_settings_api_roundtrip() -> TestResult {
     // Valid.
     let r = c
         .put(url(&a, "?message=tiny+repo"))
-        .body("[bundles]\nmin_commits = 2\n")
+        .body("[packs]\nfold_when_fresh_packs_reach = 2\n")
         .send()
         .await?;
     assert_eq!(r.status(), 200, "{}", r.text().await?);
     let r: serde_json::Value = c.get(url(&a, "")).send().await?.json().await?;
     assert_eq!(r["revision"], 1);
     assert_eq!(r["message"], "tiny repo");
-    assert!(r["toml"].as_str().unwrap().contains("min_commits = 2"));
+    assert!(
+        r["toml"]
+            .as_str()
+            .unwrap()
+            .contains("fold_when_fresh_packs_reach = 2")
+    );
     let eff = c.get(url(&a, "/effective")).send().await?.text().await?;
-    assert!(eff.contains("min_commits = 2"), "{eff}");
+    assert!(eff.contains("fold_when_fresh_packs_reach = 2"), "{eff}");
     assert!(!eff.contains("session_secret"), "{eff}");
     assert!(!eff.contains("[server]"), "{eff}");
 
@@ -2177,8 +1806,8 @@ async fn repo_settings_api_roundtrip() -> TestResult {
             .open(&id)
             .await?
             .effective_config()
-            .bundles
-            .min_commits,
+            .packs
+            .fold_when_fresh_packs_reach,
         2
     );
 
@@ -2208,8 +1837,8 @@ async fn repo_settings_api_roundtrip() -> TestResult {
     Ok(())
 }
 
-/// Settings tab backend: describe (strategies with next fire + human schedule,
-/// fields with sources), validate (preview, errors), policy validate + dry-run
+/// Settings tab backend: describe fields with sources, validate (preview, errors),
+/// and policy validate + dry-run
 /// against the last pushes.
 // multi_thread: the synchronous `git push` below must not block the runtime
 // the server runs on (a current-thread test hangs forever on the first push).
@@ -2232,18 +1861,6 @@ async fn settings_describe_validate_and_policy_dry_run() -> TestResult {
         .await?
         .json()
         .await?;
-    let strategies = d["strategies"].as_array().unwrap();
-    assert!(!strategies.is_empty());
-    let weekly = strategies.iter().find(|x| x["name"] == "weekly").unwrap();
-    assert_eq!(weekly["kind"], "full");
-    assert!(
-        weekly["schedule_human"]
-            .as_str()
-            .unwrap()
-            .contains("Sunday"),
-        "{weekly}"
-    );
-    assert!(weekly["next"].is_string());
     assert!(
         d["fields"]
             .as_array()
@@ -2256,7 +1873,7 @@ async fn settings_describe_validate_and_policy_dry_run() -> TestResult {
     // Validate: preview flips the touched field's source; errors come back as a list.
     let v: serde_json::Value = c
         .post(format!("{base}/settings/validate"))
-        .body("[bundles]\nmin_commits = 4\n")
+        .body("[packs]\nfold_when_fresh_packs_reach = 4\n")
         .send()
         .await?
         .json()
@@ -2266,7 +1883,7 @@ async fn settings_describe_validate_and_policy_dry_run() -> TestResult {
         .as_array()
         .unwrap()
         .iter()
-        .find(|f| f["key"] == "bundles.min_commits")
+        .find(|f| f["key"] == "packs.fold_when_fresh_packs_reach")
         .unwrap();
     assert_eq!(f["value"], 4);
     assert_eq!(f["source"], "setting");
@@ -2496,203 +2113,6 @@ async fn http_inflight_gauge_covers_streamed_bodies_and_returns_to_zero() -> Tes
     Ok(())
 }
 
-/// The north star's second half — fast catch-up through bundles — needs `fetch.bundleURI` on the
-/// clone: git 2.51 records only `fetch.bundleCreationToken` for an advertised bundle-uri clone, so a
-/// later `git fetch` skips bundles entirely. Every recipe we emit passes `-c fetch.bundleURI=<list>`
-/// (`setup::Recipes`). This clones the way the recipe does, pushes, cuts an incremental bundle, and
-/// asserts the fetch took it: trace2 shows the list + bundle downloads, the upload-pack remainder is
-/// tiny, and `fetch.bundleCreationToken` advanced.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn fetch_after_the_recipe_clone_uses_the_bundles() -> TestResult {
-    let server = Server::start().await?;
-    server.put_repo("t", "catchup").await?;
-    let src = TestRepo::synthetic(4, 3)?;
-    git_in(&src, &["branch", "-M", "main"])?;
-    git_in(
-        &src,
-        &["remote", "add", "origin", &server.repo_url("t", "catchup")],
-    )?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    server.build_bundle("t", "catchup", "weekly").await?;
-
-    // The recipe, verbatim from /services/setup.json (the UI's single source of truth).
-    let setup: serde_json::Value = reqwest::Client::new()
-        .get(format!(
-            "{}/services/setup.json?repo=t/catchup",
-            server.base_url
-        ))
-        .header("Authorization", "Bearer dev")
-        .send()
-        .await?
-        .json()
-        .await?;
-    let plain = setup["plain_clone"].as_str().expect("plain_clone");
-    // Fetches record the catch-up list (no fulls): `bundles/catchup`.
-    let list = format!("{}/bundles/catchup", server.repo_url("t", "catchup"));
-    assert_eq!(
-        plain,
-        format!(
-            "git clone -c fetch.bundleURI={list} {}",
-            server.repo_url("t", "catchup")
-        )
-    );
-    let catchup_text = server
-        .get_text("/t/catchup.git/bundles/catchup", &[])
-        .await?;
-    assert!(
-        !catchup_text.contains("weekly-"),
-        "the catch-up list carries no fulls:\n{catchup_text}"
-    );
-    let clone_text = server.get_text("/t/catchup.git/bundles/list", &[]).await?;
-    assert!(
-        clone_text.contains("weekly-"),
-        "the clone list does:\n{clone_text}"
-    );
-    let clone_dir = tempfile::tempdir()?;
-    let mut args: Vec<&str> = plain.split(' ').skip(1).collect(); // drop the leading "git"
-    args.insert(0, "transfer.bundleURI=true");
-    args.insert(0, "-c");
-    let dir_str = clone_dir.path().to_str().unwrap();
-    args.push(dir_str);
-    git(&args, clone_dir.path().parent().unwrap())?;
-    assert_eq!(
-        git_in(clone_dir.path(), &["config", "fetch.bundleURI"])?.trim(),
-        list,
-        "the clone recorded the list"
-    );
-    let token_before: u64 = git_in(clone_dir.path(), &["config", "fetch.bundleCreationToken"])?
-        .trim()
-        .parse()?;
-
-    // New history on the server, folded into a new incremental bundle (the maintainer's daily slot).
-    for i in 0..3 {
-        std::fs::write(src.join(format!("catchup-{i}.txt")), format!("{i}\n"))?;
-        git_in(&src, &["add", "."])?;
-        git_in(&src, &["commit", "-q", "-m", &format!("catchup {i}")])?;
-    }
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    server.build_bundle("t", "catchup", "daily").await?;
-
-    // The fetch, traced (GIT_TRACE2_EVENT needs a path git can open; a file it appends to):
-    // the bundle list + the new bundle are downloaded (the bundle is unbundled through
-    // `index-pack <file>`, never `--stdin`) and the creationToken moves to the new slot.
-    let trace_dir = tempfile::tempdir()?;
-    let trace_path = trace_dir.path().join("trace.jsonl");
-    let out = std::process::Command::new("git")
-        .current_dir(clone_dir.path())
-        .env("GIT_TRACE2_EVENT", &trace_path)
-        .args(["fetch", "origin"])
-        .output()?;
-    assert!(
-        out.status.success(),
-        "{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    assert_eq!(
-        git_in(clone_dir.path(), &["rev-parse", "origin/main"])?,
-        git_in(&src, &["rev-parse", "main"])?
-    );
-    let events = std::fs::read_to_string(&trace_path).unwrap_or_default();
-    // git downloads the list and each newer bundle with `git-remote-https <url>` children (the bundle is
-    // unbundled in-process), then negotiates the remainder with upload-pack.
-    let downloads: Vec<&str> = events
-        .lines()
-        .filter(|l| l.contains("\"child_start\"") && l.contains("git-remote-https\",\"http"))
-        .collect();
-    let list_downloads = downloads
-        .iter()
-        .filter(|l| l.contains("/bundles/catchup\""))
-        .count();
-    let bundle_downloads = downloads
-        .iter()
-        .filter(|l| l.contains("/bundles/daily/"))
-        .count();
-    assert_eq!(
-        list_downloads,
-        1,
-        "the fetch must read the catch-up list once:\n{}",
-        downloads.join("\n")
-    );
-    assert_eq!(
-        bundle_downloads,
-        1,
-        "the fetch must download the one newer (daily) bundle, never the weekly:\n{}",
-        downloads.join("\n")
-    );
-    assert!(
-        !downloads.iter().any(|l| l.contains("/bundles/weekly/")),
-        "{}",
-        downloads.join("\n")
-    );
-    let token_after: u64 = git_in(clone_dir.path(), &["config", "fetch.bundleCreationToken"])?
-        .trim()
-        .parse()?;
-    assert!(
-        token_after > token_before,
-        "creationToken must advance ({token_before} → {token_after})"
-    );
-    eprintln!(
-        "fetch: creationToken {token_before} → {token_after}; list downloads {list_downloads}, bundle downloads {bundle_downloads}"
-    );
-
-    // The weekly rollover: more history, a NEW full, then a daily cut after it. A stale client's fetch
-    // must walk daily → daily and never download the new full (on a large repository: 32 GB for every developer's
-    // first fetch after Sunday, measured on the rig 2026-08-22). The catch-up list has no fulls, and
-    // the first daily after the weekly chains on the previous daily (same tips as the weekly).
-    for i in 3..6 {
-        std::fs::write(src.join(format!("catchup-{i}.txt")), format!("{i}\n"))?;
-        git_in(&src, &["add", "."])?;
-        git_in(&src, &["commit", "-q", "-m", &format!("catchup {i}")])?;
-    }
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    // A daily at the weekly's instant and the weekly itself (Sunday 23:00 on the real calendar: the
-    // test cuts both "now" with slot 0, tokens increase with the clock).
-    server.build_bundle("t", "catchup", "daily").await?;
-    server.build_bundle("t", "catchup", "weekly").await?;
-    std::fs::write(src.join("monday.txt"), "m\n")?;
-    git_in(&src, &["add", "."])?;
-    git_in(&src, &["commit", "-q", "-m", "monday"])?;
-    git_in(&src, &["push", "-q", "origin", "main"])?;
-    server.build_bundle("t", "catchup", "daily").await?;
-    let trace_path = trace_dir.path().join("trace2.jsonl");
-    let out = std::process::Command::new("git")
-        .current_dir(clone_dir.path())
-        .env("GIT_TRACE2_EVENT", &trace_path)
-        .args(["fetch", "origin"])
-        .output()?;
-    assert!(
-        out.status.success(),
-        "{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    assert_eq!(
-        git_in(clone_dir.path(), &["rev-parse", "origin/main"])?,
-        git_in(&src, &["rev-parse", "main"])?
-    );
-    let events = std::fs::read_to_string(&trace_path).unwrap_or_default();
-    let downloads: Vec<&str> = events
-        .lines()
-        .filter(|l| l.contains("\"child_start\"") && l.contains("git-remote-https\",\"http"))
-        .collect();
-    assert!(
-        !downloads.iter().any(|l| l.contains("/bundles/weekly/")),
-        "a fetch across the weekly rollover must not download the new full:\n{}",
-        downloads.join("\n")
-    );
-    let dailies = downloads
-        .iter()
-        .filter(|l| l.contains("/bundles/daily/"))
-        .count();
-    assert_eq!(
-        dailies,
-        2,
-        "exactly the two dailies since the last fetch:\n{}",
-        downloads.join("\n")
-    );
-    assert!(git_in(clone_dir.path(), &["fsck", "--no-dangling"]).is_ok());
-    Ok(())
-}
-
 /// `/services/public/*` is the one open lane: the installer is fetched before
 /// a user has any credential. Data-free only; everything else under the prefix is 404; nothing else
 /// on the host opened up; the old installer path is gone (banner).
@@ -2726,7 +2146,7 @@ async fn public_lane_serves_only_the_installer_without_auth() -> TestResult {
         body.contains("git config --global --add \"credential.https://$HOST.helper\" \"$HELPER\""),
         "{body}"
     );
-    assert!(body.contains("-c fetch.bundleURI="), "{body}");
+    assert!(!body.contains("fetch.bundleURI"), "{body}");
     for (path, want) in [
         ("/services/public/nothing-else", 404),
         ("/services/public/", 404),
@@ -2852,8 +2272,6 @@ async fn stale_cached_credential_is_erased_by_the_401_and_replaced_on_the_next_c
         let dir = tempfile::tempdir().unwrap();
         std::process::Command::new("git")
             .args([
-                "-c",
-                "transfer.bundleURI=false",
                 "clone",
                 "-q",
                 &server.repo_url("t", "stale"),
@@ -2964,6 +2382,7 @@ async fn reads_after_an_acknowledged_push_never_show_the_previous_tip() -> TestR
         assert!(!base.is_empty());
         // 6 contenders from the same base, each with its own commit.
         let mut handles = Vec::new();
+        let start_pushes = std::sync::Arc::new(std::sync::Barrier::new(7));
         for i in 0..6 {
             let d = tempfile::tempdir()?;
             git(
@@ -2979,10 +2398,12 @@ async fn reads_after_an_acknowledged_push_never_show_the_previous_tip() -> TestR
             let sha = git_in(d.path(), &["rev-parse", "HEAD"])?.trim().to_string();
             let url2 = url.clone();
             let cwd = d.path().to_path_buf();
+            let start = start_pushes.clone();
             handles.push((
                 d,
                 sha,
                 std::thread::spawn(move || {
+                    start.wait();
                     // true when this push won
                     let o = std::process::Command::new("git")
                         .current_dir(&cwd)
@@ -3017,12 +2438,17 @@ async fn reads_after_an_acknowledged_push_never_show_the_previous_tip() -> TestR
             }
             seen
         });
+        // Every clone and commit exists before any contender may publish.
+        start_pushes.wait();
         let mut winner = None;
+        let mut winners = 0;
         for (_d, sha, h) in handles {
             if h.join().unwrap() {
+                winners += 1;
                 winner = Some(sha);
             }
         }
+        assert_eq!(winners, 1, "exactly one same-base push wins each round");
         let winner = winner.expect("exactly one push wins each round");
         // Read-your-writes: the first read after the last push returned must be the winner, and so
         // must every read after it.
diff --git a/crates/walgit-server/tests/follow.rs b/crates/walgit-server/tests/follow.rs
index a784f0f..9281207 100644
--- a/crates/walgit-server/tests/follow.rs
+++ b/crates/walgit-server/tests/follow.rs
@@ -64,8 +64,7 @@ async fn follows_upstream_refs_through_the_wal_fast_forward_only() -> anyhow::Re
             c.server.roles = vec![walgit_config::Role::Serve, walgit_config::Role::Maintain];
             c.upstream.git = Some(up_url.clone());
             c.upstream.follow = vec!["refs/heads/main".into(), "refs/tags/v1".into()];
-            c.compaction.enabled = false;
-            c.bundles.enabled = false;
+            c.packs.enabled = false;
             c.wal.snapshot_every_entries = 0;
         })
     )?;
diff --git a/crates/walgit-server/tests/forward.rs b/crates/walgit-server/tests/forward.rs
new file mode 100644
index 0000000..febe7d1
--- /dev/null
+++ b/crates/walgit-server/tests/forward.rs
@@ -0,0 +1,83 @@
+//! A buffered push is replayable only when the broker never received it.
+mod harness;
+use harness::{Server, TestRepo, git_in};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn ambiguous_delivery_and_gateway_responses_never_publish_locally() -> anyhow::Result<()> {
+    let writer = Server::start().await?;
+    writer.put_repo("o", "forward").await?;
+    let source = TestRepo::synthetic(1, 1)?;
+    git_in(
+        &source,
+        &["push", "-q", &writer.repo_url("o", "forward"), "main"],
+    )?;
+    let tip = git_in(&source, &["rev-parse", "HEAD"])?;
+    let initial_log = writer.read_log("o", "forward").await?;
+    for (name, reply, expected) in [
+        ("lost", "", 502),
+        (
+            "gateway",
+            "HTTP/1.1 503 Service Unavailable\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            503,
+        ),
+        (
+            "redirect",
+            "HTTP/1.1 307 Temporary Redirect\r\nLocation: http://127.0.0.1:1/\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            307,
+        ),
+    ] {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await?;
+        let address = listener.local_addr()?;
+        let broker = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await?;
+            let mut received = Vec::new();
+            loop {
+                received.push(stream.read_u8().await?);
+                // The forwarding stream uses HTTP/1 chunked transfer. Wait for
+                // the entire body before dropping or rejecting the response.
+                if received.ends_with(b"\r\n0\r\n\r\n") {
+                    break;
+                }
+                anyhow::ensure!(received.len() < 16384, "unexpected forwarding body");
+            }
+            stream.write_all(reply.as_bytes()).await?;
+            stream.shutdown().await?;
+            Ok::<_, anyhow::Error>(received)
+        });
+        let front = writer
+            .start_sibling_with(|cfg| {
+                cfg.wal.push_broker_url = Some(format!("http://{address}"));
+            })
+            .await?;
+        let command = format!(
+            "{} {} refs/heads/{name}\0report-status\n",
+            "0".repeat(40),
+            tip.trim()
+        );
+        let body = format!("{:04x}{command}0000", command.len() + 4);
+        let response = tokio::time::timeout(
+            std::time::Duration::from_secs(10),
+            reqwest::Client::new()
+                .post(format!(
+                    "{}/git-receive-pack",
+                    front.repo_url("o", "forward")
+                ))
+                .header("content-type", "application/x-git-receive-pack-request")
+                .body(body)
+                .send(),
+        )
+        .await??;
+        assert_eq!(response.status().as_u16(), expected);
+        let received = broker.await??;
+        assert!(String::from_utf8_lossy(&received).contains(&format!("refs/heads/{name}")));
+        assert_eq!(writer.read_log("o", "forward").await?, initial_log);
+        assert!(
+            !writer
+                .ls_remote("o", "forward")
+                .await?
+                .contains(&format!("refs/heads/{name}"))
+        );
+    }
+    Ok(())
+}
diff --git a/crates/walgit-server/tests/harness.rs b/crates/walgit-server/tests/harness.rs
index 1e64064..da9ea20 100644
--- a/crates/walgit-server/tests/harness.rs
+++ b/crates/walgit-server/tests/harness.rs
@@ -21,7 +21,6 @@ pub struct Server {
     _shutdown: tokio::sync::oneshot::Sender<()>,
     pub store: Arc<MemoryStore>,
     registry: Arc<walgit_wal::Registry>,
-    bundles: Arc<walgit_bundle::Bundler>,
     /// The instance's state (maintenance loop tests drive `run_pass` directly).
     pub state: Arc<walgit_server::AppState>,
     /// Cache dir; removed when the server is dropped (hermetic, no /tmp pile-up).
@@ -84,8 +83,6 @@ impl Server {
         cfg.wal.check_connectivity = true;
         cfg.wal.freshness_ttl = std::time::Duration::ZERO;
         cfg.git.allow_filter = true;
-        cfg.bundles.advertise = true;
-        cfg.bundles.min_commits = 0; // tests cut tiny incrementals on purpose; the gate has its own test
 
         // Allow the e2e suite to run under either upload-pack engine.
         // Default: git (the subprocess engine). Set =gix to use the
@@ -116,7 +113,6 @@ impl Server {
         let state = AppState::new(Arc::new(cfg), dyn_store).await?;
 
         let registry = state.registry.clone();
-        let bundles = state.bundles.clone();
         // Events bridge sweep timer (no-op unless the bridge is enabled).
         walgit_server::bridge::spawn_sweeper(state.clone());
 
@@ -139,7 +135,6 @@ impl Server {
             _shutdown: tx,
             store,
             registry,
-            bundles,
             state,
             _cache: cache,
         })
@@ -209,12 +204,6 @@ impl Server {
         }
     }
 
-    pub async fn build_bundle(&self, owner: &str, repo: &str, strategy: &str) -> Result<()> {
-        let id = walgit_git::RepoId::new(owner, repo)?;
-        self.bundles.build(&id, strategy).await?;
-        Ok(())
-    }
-
     pub async fn ls_remote(&self, owner: &str, repo: &str) -> Result<String> {
         let out = tokio::process::Command::new("git")
             .args(["ls-remote", &self.repo_url(owner, repo)])
diff --git a/crates/walgit-server/tests/maintain.rs b/crates/walgit-server/tests/maintain.rs
index 72c6cdd..70242f3 100644
--- a/crates/walgit-server/tests/maintain.rs
+++ b/crates/walgit-server/tests/maintain.rs
@@ -1,22 +1,107 @@
 //! The `maintain` role's pass: checkpoint-if-due (refs-level, on an instance
-//! that cannot hold the packs), bundles-if-due, compaction, all as tasks.
-
-#![allow(
-    clippy::unwrap_used,
-    clippy::expect_used,
-    clippy::panic,
-    clippy::indexing_slicing,
-    clippy::many_single_char_names
-)]
-// clippy.toml exempts #[test] functions from the panic-path lints, but not the plain
-// helper functions beside them in the same file. A panic in a fixture builder is how
-// that fixture reports it could not be built, exactly as in the tests it serves.
+//! that cannot hold the packs), compaction, all as tasks.
 
 mod harness;
 
 use harness::{Server, git, git_in};
 use std::collections::HashMap;
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn classification_preserves_push_bytes_and_shared_group_cuts_settle() -> anyhow::Result<()> {
+    use walgit_server::ops::{CompactRequest, compact_repo};
+    let server = Server::start_with_tweak(|c| {
+        c.cache.mode = walgit_config::CacheMode::Disk;
+        c.packs.frozen_coverage_target = 0.0;
+    })
+    .await?;
+    server.put_repo("o", "shared").await?;
+    let src = tempfile::tempdir()?;
+    git_in(src.path(), &["init", "-q", "-b", "main"])?;
+    git_in(
+        src.path(),
+        &["config", "user.email", "test@example.invalid"],
+    )?;
+    git_in(src.path(), &["config", "user.name", "Test"])?;
+    std::fs::write(src.path().join("shared.txt"), "shared bytes\n")?;
+    git_in(src.path(), &["add", "."])?;
+    git_in(src.path(), &["commit", "-q", "-m", "code"])?;
+    git(
+        &["push", "-q", &server.repo_url("o", "shared"), "main"],
+        src.path(),
+    )?;
+    let handle = server
+        .state
+        .registry
+        .open(&walgit_git::RepoId::new("o", "shared")?)
+        .await?;
+    let before = handle.manifest().packs.clone();
+    compact_repo(&handle, CompactRequest::default(), &|_| {}).await?;
+    let after = handle.manifest();
+    assert_eq!(before.len(), after.packs.len());
+    for (old, new) in before.iter().zip(&after.packs) {
+        assert_eq!(
+            (&old.checksum, old.pack_size, old.tier),
+            (&new.checksum, new.pack_size, new.tier)
+        );
+        assert_eq!(new.pack_groups, ["code"]);
+    }
+    // A distinct metadata commit shares the complete tree/blob with code.
+    git_in(src.path(), &["checkout", "-q", "--orphan", "meta"])?;
+    git_in(src.path(), &["commit", "-q", "-m", "metadata"])?;
+    let meta = git_in(src.path(), &["rev-parse", "HEAD"])?;
+    git(
+        &[
+            "push",
+            "-q",
+            &server.repo_url("o", "shared"),
+            "HEAD:refs/meta/state",
+        ],
+        src.path(),
+    )?;
+    compact_repo(
+        &handle,
+        CompactRequest {
+            force: true,
+            rebuild_base: true,
+        },
+        &|_| {},
+    )
+    .await?;
+    // Repair certificates after the conserving cut; it must not recut shared bytes.
+    compact_repo(&handle, CompactRequest::default(), &|_| {}).await?;
+    let stable = handle.manifest();
+    assert!(
+        stable
+            .packs
+            .iter()
+            .any(|p| p.pack_groups.contains(&"code".into())
+                && p.pack_groups.contains(&"meta".into()))
+    );
+    for _ in 0..3 {
+        compact_repo(&handle, CompactRequest::default(), &|_| {}).await?;
+        assert_eq!(handle.manifest().packs, stable.packs);
+    }
+    let cold = server.start_sibling_with(|_| {}).await?;
+    let clone = tempfile::tempdir()?;
+    git(
+        &[
+            "clone",
+            "-q",
+            "--mirror",
+            "--server-option=ref-view=all",
+            &cold.repo_url("o", "shared"),
+            clone.path().to_str().unwrap(),
+        ],
+        src.path(),
+    )?;
+    assert_eq!(
+        git_in(clone.path(), &["rev-parse", "refs/meta/state"])?.trim(),
+        meta.trim()
+    );
+    git_in(clone.path(), &["fsck", "--strict"])?;
+    Ok(())
+}
+
 /// Every await is bounded so a hang names the step instead of stalling CI.
 macro_rules! step {
     ($name:literal, $e:expr) => {
@@ -69,8 +154,7 @@ async fn pass_checkpoints_due_repos_refs_level_and_reports_tasks() -> anyhow::Re
             c.cache.max_bytes = walgit_config::ByteSize::b(1);
             c.wal.snapshot_every_entries = 0;
             c.wal.checkpoint_interval = std::time::Duration::from_millis(1);
-            c.compaction.enabled = false;
-            c.bundles.enabled = false;
+            c.packs.enabled = false;
         })
     )?;
     tokio::time::sleep(std::time::Duration::from_millis(5)).await;
@@ -110,67 +194,27 @@ async fn pass_checkpoints_due_repos_refs_level_and_reports_tasks() -> anyhow::Re
     )?;
     assert_eq!(report.checkpoints, 0);
 
-    // Bundles from a maintainer that never served this repo: the build must
-    // materialize the packs itself (prod failed with "bad object refs/heads/main").
-    let bundler = step!(
-        "start bundler",
+    // An object-capable maintainer audits the checkpointed repository once.
+    let auditor = step!(
+        "start auditor",
         front.start_sibling_with(|c| {
             c.server.roles = vec![walgit_config::Role::Maintain];
             c.wal.snapshot_every_entries = 0;
-            c.compaction.enabled = false;
-            c.bundles.enabled = true;
+            c.packs.enabled = false;
         })
     )?;
-    // Priority loop: the first unit is the missing weekly slot (checkpoint is
-    // not due), one unit per pass, next pass moves to the daily chain, and a
-    // re-run after everything is built is idempotent (Idle).
     let id = walgit_git::RepoId::new("o", "r")?;
-    assert!(
-        matches!(step!("unit 1", next_unit(&bundler.state, &id))?, Unit::BundleSlot(ref s, _) if s == "weekly")
-    );
-    let report = step!("bundler pass", run_pass(&bundler.state))?;
-    assert_eq!((report.units, report.bundles), (1, 1), "{report:?}");
-    let list = step!(
-        "bundle list",
-        bundler.get_text("/o/r.git/bundles/list", &[])
-    )?;
-    assert!(list.contains("[bundle \"weekly-"), "{list}");
-    // Weekly token = its slot (a Sunday 23:00 UTC epoch, divisible by 3600).
-    let tok: u64 = list
-        .lines()
-        .find_map(|l| {
-            l.trim()
-                .strip_prefix("creationToken = ")
-                .and_then(|v| v.parse().ok())
-        })
-        .unwrap();
-    assert_eq!(tok % 3600, 0, "token is a slot epoch: {tok}");
-    // Next units: dailies (oldest first) — but a daily slot with no new objects
-    // over the weekly is skipped — then the lowest-priority audit (fsck, once;
-    // clean), so the loop converges to Idle.
-    let mut audits = 0;
-    for _ in 0..40 {
-        match step!("unit n", next_unit(&bundler.state, &id))? {
-            Unit::Idle => break,
-            Unit::BundleSlot(..) => {
-                let _ = step!("pass n", run_pass(&bundler.state))?;
-            }
-            Unit::Fsck(_) => {
-                audits += 1;
-                let _ = step!("pass fsck", run_pass(&bundler.state))?;
-            }
-            other => panic!("unexpected unit {other:?}"),
-        }
-    }
-    assert_eq!(
-        audits, 1,
-        "the audit runs once (never audited) and is then not due for fsck_interval"
-    );
+    assert!(matches!(
+        step!("audit due", next_unit(&auditor.state, &id))?,
+        Unit::Fsck(_)
+    ));
+    let report = step!("audit pass", run_pass(&auditor.state))?;
+    assert_eq!(report.units, 1, "{report:?}");
     assert_eq!(
-        step!("unit idle", next_unit(&bundler.state, &id))?,
+        step!("unit idle", next_unit(&auditor.state, &id))?,
         Unit::Idle
     );
-    let report = step!("idempotent pass", run_pass(&bundler.state))?;
+    let report = step!("idempotent pass", run_pass(&auditor.state))?;
     assert_eq!(report.units, 0, "{report:?}");
     // Placement by rule: a maintainer not assigned to the repo plans nothing.
     let elsewhere = step!(
@@ -288,8 +332,7 @@ async fn fsck_unit_records_missing_objects_and_repair_unit_fetches_them_from_ups
         Server::start_with_tweak(|c| {
             c.git.allow_any_sha1_in_want = true;
             c.maintenance.checkpoints = false;
-            c.compaction.enabled = false;
-            c.bundles.enabled = false;
+            c.packs.enabled = false;
             c.maintenance.fsck_interval = std::time::Duration::from_hours(1);
         })
     )?;
@@ -686,287 +729,9 @@ async fn host_excluded_from_serving_a_repo_refuses_object_work_with_503() -> any
     Ok(())
 }
 
-/// The static bundle list must show a bundle this host just built — the list is
-/// cached per repo (TTL) and the `bundle` op invalidates it. Prod 2026-08-21:
-/// the SSD host advertised 4 hourlies for 20+ min after it had published the 5th
-/// (the cache was keyed by manifest version, which a publish does not change).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn bundle_list_shows_a_bundle_right_after_this_host_builds_it() -> anyhow::Result<()> {
-    let server = step!(
-        "start",
-        Server::start_with_tweak(|c| {
-            c.server.roles = vec![walgit_config::Role::Serve, walgit_config::Role::Maintain];
-            c.bundles.enabled = true;
-            c.bundles.min_commits = 1;
-            c.compaction.enabled = false;
-            c.maintenance.checkpoints = false;
-        })
-    )?;
-    step!("put repo", server.put_repo("o", "r"))?;
-    let src = tempfile::tempdir()?;
-    git_in(src.path(), &["init", "-q", "-b", "main"])?;
-    git_in(src.path(), &["config", "user.email", "t@t"])?;
-    git_in(src.path(), &["config", "user.name", "Tester"])?;
-    std::fs::write(src.path().join("f.txt"), "one\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "one"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-
-    // Weekly via the op (what the maintainer runs), then read + cache the list.
-    let id = walgit_git::RepoId::new("o", "r")?;
-    let mut params = std::collections::HashMap::new();
-    params.insert("strategy".to_string(), "weekly".to_string());
-    let t = walgit_server::ops::start(server.state.clone(), id.clone(), "bundle", params)
-        .await
-        .map_err(|_| anyhow::anyhow!("op start failed"))?;
-    assert!(t.wait_done(std::time::Duration::from_secs(30)).await);
-    let list1 = step!("list 1", server.get_text("/o/r.git/bundles/list", &[]))?;
-    assert!(list1.contains("[bundle \"weekly-"), "{list1}");
-    assert!(!list1.contains("daily-"));
-    let _again = step!(
-        "list 1 again (cached)",
-        server.get_text("/o/r.git/bundles/list", &[])
-    )?;
-
-    // New objects, a daily built by the op → the NEXT list shows it, no TTL wait.
-    std::fs::write(src.path().join("g.txt"), "two\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "two"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    let mut params = std::collections::HashMap::new();
-    params.insert("strategy".to_string(), "daily".to_string());
-    let t = walgit_server::ops::start(server.state.clone(), id.clone(), "bundle", params)
-        .await
-        .map_err(|_| anyhow::anyhow!("op start failed"))?;
-    assert!(t.wait_done(std::time::Duration::from_secs(30)).await);
-    assert!(t.outcome().is_some_and(|o| o.is_ok()), "{:?}", t.outcome());
-    let list2 = step!("list 2", server.get_text("/o/r.git/bundles/list", &[]))?;
-    assert!(
-        list2.contains("[bundle \"daily-"),
-        "the list served right after the build must contain it:\n{list2}"
-    );
-
-    // Another host on the same bucket, which cached the list BEFORE the next build
-    // and is never told about it: its next GET must still be fresh (the cache is
-    // keyed by list.pb's own version, probed per request — not by a TTL).
-    let other = step!(
-        "start other",
-        server.start_sibling_with(|c| {
-            c.bundles.enabled = true;
-        })
-    )?;
-    let seen = step!("other list", other.get_text("/o/r.git/bundles/list", &[]))?;
-    assert!(seen.contains("daily-") && !seen.contains("hourly-"));
-    std::fs::write(src.path().join("h.txt"), "three\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "three"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    let mut params = std::collections::HashMap::new();
-    params.insert("strategy".to_string(), "hourly".to_string());
-    let t = walgit_server::ops::start(server.state.clone(), id.clone(), "bundle", params)
-        .await
-        .map_err(|_| anyhow::anyhow!("op start failed"))?;
-    assert!(t.wait_done(std::time::Duration::from_secs(30)).await);
-    let list3 = step!(
-        "other list after a build elsewhere",
-        other.get_text("/o/r.git/bundles/list", &[])
-    )?;
-    assert!(
-        list3.contains("[bundle \"hourly-"),
-        "a host that did not build must still serve the new list at once:\n{list3}"
-    );
-    Ok(())
-}
-
-/// A hundred closed hourly slots with nothing to cut must not cost a hundred passes
-/// (closed = the slot's as-of instant has passed, whatever the strategy's period —
-/// a daily is final an hour after 23:00, not at the next 23:00):
-/// `next_unit` settles them at plan time (refs-level; verdicts recorded in the
-/// list), and the live slot with real objects is built in the SAME pass.
+/// Manual base rebuilding conserves the imported base and subsequent pushes.
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn one_pass_settles_all_closed_empty_slots() -> anyhow::Result<()> {
-    let server = step!(
-        "start",
-        Server::start_with_tweak(|c| {
-            c.server.roles = vec![walgit_config::Role::Serve, walgit_config::Role::Maintain];
-            c.bundles.enabled = true;
-            c.bundles.main_only = true;
-            c.bundles.min_commits = 1;
-            c.compaction.enabled = false;
-            c.maintenance.checkpoints = false;
-            c.maintenance.fsck_interval = std::time::Duration::ZERO;
-            // weekly (full) + hourly on weekly: the closed hours since the weekly are empty.
-            c.bundles.strategy.retain(|s| s.name != "daily");
-            for s in &mut c.bundles.strategy {
-                if s.name == "hourly" {
-                    s.base = Some("weekly".into());
-                    s.backfill_max = 0;
-                }
-            }
-        })
-    )?;
-    step!("put repo", server.put_repo("o", "r"))?;
-    let src = tempfile::tempdir()?;
-    git_in(src.path(), &["init", "-q", "-b", "main"])?;
-    git_in(src.path(), &["config", "user.email", "t@t"])?;
-    git_in(src.path(), &["config", "user.name", "Tester"])?;
-    std::fs::write(src.path().join("f.txt"), "one\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "one"])?;
-    // Publish the first state 31 hours in the past so that 30 closed hourly slots exist.
-    let id = walgit_git::RepoId::new("o", "r")?;
-    let h = step!("open", server.state.registry.open(&id))?;
-    let now = std::time::SystemTime::now();
-    let c1 = git_in(src.path(), &["rev-parse", "HEAD"])?
-        .trim()
-        .to_string();
-    // Push normally first (objects), then time-shift the ref history with an explicit created_at.
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    step!("sync", h.sync())?;
-    // A weekly cut at the Sunday before yesterday (earliest state), via the op.
-    let weekly = server
-        .state
-        .cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "weekly")
-        .unwrap()
-        .clone();
-    let sunday = walgit_bundle::slots::last_slot_at_or_before(
-        &weekly,
-        now - std::time::Duration::from_hours(36),
-    )?
-    .unwrap();
-    let mut params = std::collections::HashMap::new();
-    params.insert("strategy".to_string(), "weekly".to_string());
-    params.insert("slot".to_string(), sunday.to_string());
-    let t = walgit_server::ops::start(server.state.clone(), id.clone(), "bundle", params)
-        .await
-        .map_err(|_| anyhow::anyhow!("op start"))?;
-    assert!(t.wait_done(std::time::Duration::from_secs(30)).await);
-    let list = walgit_bundle::ops::read_list(h.store())
-        .await?
-        .expect("list");
-    assert_eq!(list.bundles.len(), 1, "{list:?}");
-    drop(c1);
-
-    // New objects NOW (the live hour has real work).
-    std::fs::write(src.path().join("g.txt"), "two\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "two"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-
-    // Plan before: only the two newest hourly slots are wanted (D21, 2026-08-22) — the older ones
-    // are not work even though they are missing; the closed one of the two is empty (the weekly
-    // holds everything up to now-ish).
-    let ctx = walgit_bundle::slots::PlanContext {
-        first_state: h.first_state_time(),
-        can_full: true,
-        can_incremental: true,
-        wrong_host_reason: None,
-    };
-    let rows = server.state.bundles.plan(&id, now, ctx).await?;
-    // Missing or Pending: `plan` emits a row only for the newest INCREMENTALS_KEPT slots, so the
-    // row count is the window width, which is what this asserts. Whether the newest slot reads
-    // Missing or Pending depends on where `now` falls inside the hour (`slot_closed` wants
-    // SLOT_CLOSE_GRACE past the fire time), and that is not a property of the window.
-    let missing_before = rows
-        .iter()
-        .filter(|r| {
-            r.strategy == "hourly"
-                && matches!(
-                    r.status,
-                    walgit_bundle::slots::SlotStatus::Missing
-                        | walgit_bundle::slots::SlotStatus::Pending
-                )
-        })
-        .count();
-    assert_eq!(
-        missing_before,
-        walgit_bundle::slots::INCREMENTALS_KEPT,
-        "only the newest slots are planned: {rows:?}"
-    );
-
-    // ONE pass.
-    let report = step!("pass", walgit_server::maintain::run_pass(&server.state))?;
-    let list = walgit_bundle::ops::read_list(h.store())
-        .await?
-        .expect("list");
-    let hourlies: Vec<_> = list
-        .bundles
-        .iter()
-        .filter(|b| b.strategy == "hourly")
-        .collect();
-    assert!(
-        !list.skipped.is_empty(),
-        "closed empty slots recorded in the list: {report:?}"
-    );
-    // Every CLOSED missing slot is settled in that one pass. The open (current)
-    // slot may stay missing: the commit above was pushed after its fire time, so
-    // as of the slot there is nothing new — it belongs to the next hour (D22).
-    let hourly = server
-        .state
-        .cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "hourly")
-        .unwrap()
-        .clone();
-    // Re-plan as of the same `now` the first plan used, not a fresh clock read. `slot_closed` is
-    // monotonic in time and the pass ran after `now`, so every slot closed at `now` was already
-    // closed while the pass planned: anything still missing here is a real settling failure. A
-    // fresh read would instead pick up an hour that fired *during* the pass, which no pass could
-    // have settled.
-    let rows = server.state.bundles.plan(&id, now, ctx).await?;
-    let still_missing_closed: Vec<u64> = rows
-        .iter()
-        .filter(|r| {
-            r.strategy == "hourly"
-                && r.status == walgit_bundle::slots::SlotStatus::Missing
-                && walgit_bundle::slots::slot_closed(&hourly, r.slot, now)
-        })
-        .map(|r| r.slot)
-        .collect();
-    assert!(
-        still_missing_closed.is_empty(),
-        "after one pass no closed slot stays missing: {still_missing_closed:?}\nskipped={} built={}",
-        list.skipped.len(),
-        hourlies.len()
-    );
-    assert!(
-        list.skipped.len() >= missing_before - 1,
-        "settled at plan time, not one per pass: skipped={} missing_before={missing_before}",
-        list.skipped.len()
-    );
-    Ok(())
-}
-
-/// Sunday's weekly on an ssd maintainer (the SSD host): the missing full slot of a
-/// repository that has a tier-2 base and pushes since it first yields
-/// `BaseRebuild` (compact --base: new base + history pack + checkpoint), then the
-/// full slot itself, which COMPOSES header ∘ base (no pack-objects of the
-/// history). Pushes landing after the rebuild do not re-trigger it this week.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -> anyhow::Result<()>
-{
-    use walgit_server::maintain::{Unit, next_unit, run_pass};
+async fn manual_base_rebuild_on_an_ssd_maintainer() -> anyhow::Result<()> {
     let server = step!(
         "start",
         Server::start_with_tweak(|c| {
@@ -974,13 +739,10 @@ async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -
                 walgit_config::Role::Serve,
                 walgit_config::Role::Maintain,
                 walgit_config::Role::Compact,
-                walgit_config::Role::Bundle,
             ];
             c.maintenance.disk = walgit_config::MaintainerDisk::Ssd;
             c.cache.mode = walgit_config::CacheMode::Disk;
-            c.bundles.enabled = true;
-            c.bundles.strategy.truncate(1); // weekly only
-            c.compaction.enabled = true;
+            c.packs.enabled = true;
             c.maintenance.checkpoints = false;
             c.maintenance.fsck_interval = std::time::Duration::ZERO;
         })
@@ -1053,18 +815,26 @@ async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -
     )?;
     step!("sync after push", h.sync())?;
 
-    // The missing weekly slot → rebuild the base first.
-    let unit = step!("plan 1", next_unit(&server.state, &id))?;
+    let outcome = step!(
+        "manual rebuild",
+        walgit_server::ops::compact_repo(
+            &h,
+            walgit_server::ops::CompactRequest {
+                force: true,
+                rebuild_base: true
+            },
+            &|_| {},
+        )
+    )?;
     assert!(
-        matches!(unit, Unit::BaseRebuild(ref s, _) if s == "weekly"),
-        "{unit:?}"
-    );
-    let report = step!("pass 1 (rebuild)", run_pass(&server.state))?;
-    assert_eq!(
-        report.compactions,
-        1,
-        "rebuild unit: {report:?}\ntasks: {}",
-        server.get_text("/o/r/api/tasks", &[]).await?
+        matches!(
+            outcome,
+            walgit_server::ops::CompactOutcome::Published {
+                rebuild_base: true,
+                ..
+            }
+        ),
+        "{outcome:?}"
     );
     step!("sync after rebuild", h.sync())?;
     let base2 = h
@@ -1086,62 +856,7 @@ async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -
             .collect::<Vec<_>>()
     );
 
-    // A push lands between the rebuild and the compose (the rig's churn, 2026-08-22: the compose
-    // refused for as long as refs kept moving — "no ref snapshot at the base's seq"). The header
-    // must carry the refs AT THE BASE'S SEQ (replayed from the WAL), not the new tip.
-    let base_tip = git_in(src.path(), &["rev-parse", "HEAD"])?
-        .trim()
-        .to_string();
-    std::fs::write(src.path().join("between.txt"), "between\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "between"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    step!("sync after push between", h.sync())?;
-
-    // Next: the weekly slot itself, composed from the new base.
-    let unit = step!("plan 2", next_unit(&server.state, &id))?;
-    assert!(
-        matches!(unit, Unit::BundleSlot(ref s, _) if s == "weekly"),
-        "{unit:?}"
-    );
-    let report = step!("pass 2 (compose)", run_pass(&server.state))?;
-    assert_eq!(
-        report.bundles,
-        1,
-        "compose unit: {report:?}\ntasks: {}",
-        server.get_text("/o/r/api/tasks", &[]).await?
-    );
-    let list = walgit_bundle::ops::read_list(h.store())
-        .await?
-        .expect("list");
-    let weekly = list
-        .bundles
-        .iter()
-        .find(|b| b.strategy == "weekly")
-        .expect("weekly entry");
-    let m2 = h.manifest();
-    let base_pack = m2.packs.iter().find(|p| p.checksum == base2).unwrap();
-    assert!(
-        weekly.size > base_pack.pack_size && weekly.size < base_pack.pack_size + 4096,
-        "composed = header ∘ base pack: {} vs pack {}",
-        weekly.size,
-        base_pack.pack_size
-    );
-    assert_eq!(weekly.seq, base_pack.seq);
-    let main_tip = weekly
-        .tips
-        .iter()
-        .find(|t| t.name == "refs/heads/main")
-        .expect("main tip");
-    assert_eq!(
-        main_tip.oid, base_tip,
-        "the header carries main as of the base's seq, not the push that landed since"
-    );
-
-    // A push after the rebuild: no second rebuild this week; the plan is idle (slot built).
+    // A push after the rebuild remains readable without another rebuild.
     std::fs::write(src.path().join("h.txt"), "three\n")?;
     git_in(src.path(), &["add", "."])?;
     git_in(src.path(), &["commit", "-q", "-m", "three"])?;
@@ -1150,12 +865,7 @@ async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -
         src.path(),
     )?;
     step!("sync after push 2", h.sync())?;
-    let unit = step!("plan 3", next_unit(&server.state, &id))?;
-    assert!(!matches!(unit, Unit::BaseRebuild(..)), "{unit:?}");
-
-    // An imported multi-pack set (large-repository measurement: 11 tier-2 packs, the 32 GB
-    // base among 5 MB ones) is itself a reason to rebuild next week: the
-    // compose needs exactly one base, and "the base" is the biggest one.
+    // Additional imported tier-2 packs remain represented in the inventory.
     let extra = tempfile::tempdir()?;
     let blob = git_in(src.path(), &["rev-parse", "HEAD:h.txt"])?
         .trim()
@@ -1192,20 +902,21 @@ async fn weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer() -
         base2,
         "the base is the biggest tier-2 pack, not the newest"
     );
-    let next_weekly =
-        walgit_bundle::slots::from_epoch(weekly.slot) + std::time::Duration::from_hours(168);
-    let up = walgit_server::maintain::upcoming(
-        &h,
-        &h.effective_config(),
-        &walgit_server::maintain::heartbeats(&server.state).await?,
-        next_weekly - std::time::Duration::from_mins(1),
-    )
-    .await;
-    let w = up
-        .iter()
-        .find(|u| u.strategy == "weekly")
-        .expect("weekly row");
-    assert!(w.unit.starts_with("base rebuild"), "{w:?}");
+    let clone = tempfile::tempdir()?;
+    git(
+        &[
+            "clone",
+            "-q",
+            &server.repo_url("o", "r"),
+            clone.path().to_str().unwrap(),
+        ],
+        clone.path().parent().unwrap(),
+    )?;
+    git_in(clone.path(), &["fsck", "--strict"])?;
+    assert_eq!(
+        git_in(clone.path(), &["rev-parse", "HEAD"])?,
+        git_in(src.path(), &["rev-parse", "HEAD"])?
+    );
     Ok(())
 }
 
@@ -1221,8 +932,7 @@ async fn maintainer_builds_and_publishes_missing_rev_indexes() -> anyhow::Result
         "start",
         Server::start_with_tweak(|c| {
             c.maintenance.checkpoints = false;
-            c.compaction.enabled = false;
-            c.bundles.enabled = false;
+            c.packs.enabled = false;
             c.maintenance.fsck_interval = std::time::Duration::ZERO;
         })
     )?;
@@ -1367,650 +1077,39 @@ async fn maintainer_builds_and_publishes_missing_rev_indexes() -> anyhow::Result
     Ok(())
 }
 
-/// An incremental slot whose tip set equals the newest built incremental of
-/// the strategy on the same base is `skipped (unchanged since <id>)` — recorded
-/// like too-small, never cut. Without it an idle night cuts 23–48 identical
-/// 315 MB hourlies on a large repository (2026-08-21 08:00/09:00/10:00, same tip, no push
-/// since 06:43Z): `min_commits` counts since the BASE, not since the previous
-/// incremental. Clients are unaffected (git stops at the first bundle whose
-/// prerequisites it has).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn identical_incremental_slots_are_skipped_as_unchanged() -> anyhow::Result<()> {
-    let server = step!(
-        "start",
-        Server::start_with_tweak(|c| {
-            c.server.roles = vec![walgit_config::Role::Serve, walgit_config::Role::Maintain];
-            c.bundles.enabled = true;
-            c.bundles.main_only = true;
-            c.bundles.min_commits = 1;
-            c.compaction.enabled = false;
-            c.maintenance.checkpoints = false;
-            c.maintenance.fsck_interval = std::time::Duration::ZERO;
-            c.bundles.strategy.retain(|s| s.name != "daily");
-            for s in &mut c.bundles.strategy {
-                if s.name == "hourly" {
-                    s.base = Some("weekly".into());
-                    s.backfill_max = 0;
-                }
-            }
-        })
-    )?;
-    step!("put repo", server.put_repo("o", "r"))?;
-    let src = tempfile::tempdir()?;
-    git_in(src.path(), &["init", "-q", "-b", "main"])?;
-    git_in(src.path(), &["config", "user.email", "t@t"])?;
-    git_in(src.path(), &["config", "user.name", "Tester"])?;
-    std::fs::write(src.path().join("f.txt"), "one\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "one"])?;
-    let c1 = git_in(src.path(), &["rev-parse", "HEAD"])?
-        .trim()
-        .to_string();
-    std::fs::write(src.path().join("g.txt"), "two\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "two"])?;
-    let c2 = git_in(src.path(), &["rev-parse", "HEAD"])?
-        .trim()
-        .to_string();
-    let id = walgit_git::RepoId::new("o", "r")?;
-    let h = step!("open", server.state.registry.open(&id))?;
-    let now = std::time::SystemTime::now();
-    let hour = std::time::Duration::from_hours(1);
-    // History with explicit times: c1 ten days ago (so a weekly slot with state
-    // exists — a full with no state is cut from now), c2 six hours ago, nothing since.
-    let pack_of = |revs: &str| -> anyhow::Result<Vec<u8>> {
-        let out = std::process::Command::new("sh")
-            .arg("-c")
-            .arg(format!(
-                "git rev-list --objects {revs} | git pack-objects --stdout"
-            ))
-            .current_dir(src.path())
-            .output()?;
-        Ok(out.stdout)
-    };
-    let txn = |name: &str, old: &str, new: &str| walgit_proto::v1::RefTransaction {
-        updates: vec![walgit_proto::v1::RefUpdate {
-            name: name.into(),
-            old_oid: old.into(),
-            new_oid: new.into(),
-            ..Default::default()
-        }],
-        ..Default::default()
-    };
-    let ingest = |bytes: Vec<u8>| async {
-        h.local()
-            .ingest_pack(
-                std::io::Cursor::new(bytes),
-                walgit_git::IngestOptions {
-                    fsck: false,
-                    max_bytes: None,
-                    thin: false,
-                },
-            )
-            .await
-            .unwrap()
-            .unwrap()
-    };
-    let p1 = ingest(pack_of(&c1)?).await;
-    step!(
-        "c1 ten days ago",
-        h.publish_push_at(
-            Some(p1),
-            txn("refs/heads/main", "", &c1),
-            HashMap::default(),
-            now - 240 * hour
-        )
-    )?;
-    let p2 = ingest(pack_of(&format!("{c2} ^{c1}"))?).await;
-    step!(
-        "c2 six hours ago",
-        h.publish_push_at(
-            Some(p2),
-            txn("refs/heads/main", &c1, &c2),
-            HashMap::default(),
-            now - 6 * hour
-        )
-    )?;
-    step!("sync", h.sync())?;
-
-    // Weekly at the last Sunday before c2 (state as of then: c1).
-    let weekly = server
-        .state
-        .cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "weekly")
-        .unwrap()
-        .clone();
-    let sunday = walgit_bundle::slots::last_slot_at_or_before(&weekly, now - 48 * hour)?.unwrap();
-    let mut params = std::collections::HashMap::new();
-    params.insert("strategy".to_string(), "weekly".to_string());
-    params.insert("slot".to_string(), sunday.to_string());
-    let t = walgit_server::ops::start(server.state.clone(), id.clone(), "bundle", params)
-        .await
-        .map_err(|_| anyhow::anyhow!("op start"))?;
-    assert!(t.wait_done(std::time::Duration::from_secs(30)).await);
-
-    // Passes until idle: exactly ONE hourly (the slot that first sees c2); every
-    // later closed slot is recorded `unchanged since <that hourly>`.
-    for _ in 0..8 {
-        let report = step!("pass", walgit_server::maintain::run_pass(&server.state))?;
-        if report.units == 0 {
-            break;
-        }
-    }
-    let list = walgit_bundle::ops::read_list(h.store())
-        .await?
-        .expect("list");
-    let hourlies: Vec<_> = list
-        .bundles
-        .iter()
-        .filter(|b| b.strategy == "hourly")
-        .collect();
-    let hourly = server
-        .state
-        .cfg
-        .bundles
-        .strategy
-        .iter()
-        .find(|s| s.name == "hourly")
-        .unwrap()
-        .clone();
-    let ctx = walgit_bundle::slots::PlanContext {
-        first_state: h.first_state_time(),
-        can_full: true,
-        can_incremental: true,
-        wrong_host_reason: None,
-    };
-    let rows = server
-        .state
-        .bundles
-        .plan(&id, std::time::SystemTime::now(), ctx)
+/// Manual force and full-cut requests obey committed repository disablement.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn manual_pack_work_cannot_override_saved_disablement() -> anyhow::Result<()> {
+    let server = Server::start_with_tweak(|cfg| cfg.packs.enabled = true).await?;
+    server.put_repo("o", "disabled").await?;
+    let id = walgit_git::RepoId::new("o", "disabled")?;
+    let handle = server.state.registry.open(&id).await?;
+    handle
+        .publish_settings("[packs]\nenabled = false\n", "admin", "pause maintenance")
         .await?;
-    let dbg: Vec<_> = rows
-        .iter()
-        .filter(|r| r.strategy == "hourly")
-        .map(|r| (r.slot, format!("{:?}", r.status)))
-        .collect();
-    assert_eq!(
-        hourlies.len(),
-        1,
-        "one hourly carries c2; the identical later slots are not cut: {:?}\nbundles={:?}\nskipped={:?}\nplan={dbg:#?}",
-        hourlies.iter().map(|b| (&b.id, b.slot)).collect::<Vec<_>>(),
-        list.bundles
-            .iter()
-            .map(|b| (&b.id, b.slot))
-            .collect::<Vec<_>>(),
-        list.skipped
-            .iter()
-            .map(|s| (s.slot, &s.reason))
-            .collect::<Vec<_>>()
-    );
-    assert_eq!(
-        hourlies[0]
-            .tips
-            .iter()
-            .map(|t| t.oid.as_str())
-            .collect::<Vec<_>>(),
-        vec![c2.as_str()]
-    );
-    let unchanged: Vec<_> = list
-        .skipped
-        .iter()
-        .filter(|s| s.reason.starts_with("unchanged since "))
-        .collect();
-    // With only the two newest slots ever planned (D21, 2026-08-22) that is the one slot after it —
-    // settled as unchanged once it is *closed* (120 s past its fire time); in the first two minutes of
-    // an hour it is still open and legitimately not recorded yet.
-    let other_slot = rows
-        .iter()
-        .filter(|r| r.strategy == "hourly" && r.slot != hourlies[0].slot)
-        .map(|r| r.slot)
-        .max();
-    let other_closed = other_slot.is_some_and(|s| {
-        walgit_bundle::slots::slot_closed(&hourly, s, std::time::SystemTime::now())
-    });
-    assert!(
-        !other_closed || !unchanged.is_empty(),
-        "the closed hour after it is skipped as unchanged: {:?}",
-        list.skipped
-            .iter()
-            .map(|s| (s.slot, &s.reason))
-            .collect::<Vec<_>>()
-    );
-    assert!(
-        unchanged.iter().all(
-            |s| s.reason == format!("unchanged since {}", hourlies[0].id)
-                && s.slot > hourlies[0].slot
-        ),
-        "{unchanged:?}"
-    );
-    // And the plan shows them so — nothing is re-measured.
-    let closed_missing = rows
-        .iter()
-        .filter(|r| {
-            r.strategy == "hourly"
-                && r.status == walgit_bundle::slots::SlotStatus::Missing
-                && walgit_bundle::slots::slot_closed(&hourly, r.slot, std::time::SystemTime::now())
-        })
-        .count();
-    assert_eq!(closed_missing, 0, "{rows:?}");
-    Ok(())
-}
-
-/// The blobless bundle family (`filter = "blob:none"` strategies): the weekly
-/// "history" bundle is the D18 history pack composed under a `@filter=blob:none`
-/// header, incrementals pack with `--filter=blob:none`; they are advertised ONLY
-/// at `bundles/list?filter=blob:none` (git does not match `bundle.<id>.filter`
-/// against the clone's filter — a full clone would swallow them). A
-/// `--filter=blob:none --bundle-uri=<that list>` clone seeds from them and
-/// fetches blobs lazily; a full clone with the protocol list never sees them.
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn blobless_bundle_family_is_composed_from_the_history_pack_and_served_on_its_own_list()
--> anyhow::Result<()> {
-    use walgit_server::maintain::{Unit, next_unit, run_pass};
-    let server = step!(
-        "start",
-        Server::start_with_tweak(|c| {
-            c.server.roles = vec![
-                walgit_config::Role::Serve,
-                walgit_config::Role::Maintain,
-                walgit_config::Role::Compact,
-                walgit_config::Role::Bundle,
-            ];
-            c.maintenance.disk = walgit_config::MaintainerDisk::Ssd;
-            c.cache.mode = walgit_config::CacheMode::Disk;
-            c.bundles.enabled = true;
-            c.bundles.min_commits = 1;
-            c.bundles.strategy.truncate(1); // weekly (full, unfiltered)
-            let weekly = c.bundles.strategy[0].clone();
-            c.bundles.strategy.push(walgit_config::BundleStrategy {
-                name: "weekly-history".into(),
-                filter: Some("blob:none".into()),
-                ..weekly.clone()
-            });
-            c.bundles.strategy.push(walgit_config::BundleStrategy {
-                name: "hourly-history".into(),
-                kind: walgit_config::BundleKind::Incremental,
-                base: Some("weekly-history".into()),
-                schedule: "0 0 * * * *".into(),
-                keep: 0,
-                filter: Some("blob:none".into()),
-                backfill_max: 0,
-                ..weekly
-            });
-            c.compaction.enabled = true;
-            c.maintenance.checkpoints = false;
-            c.maintenance.fsck_interval = std::time::Duration::ZERO;
-        })
-    )?;
-    step!("put repo", server.put_repo("o", "r"))?;
-    let src = tempfile::tempdir()?;
-    git_in(src.path(), &["init", "-q", "-b", "main"])?;
-    git_in(src.path(), &["config", "user.email", "t@t"])?;
-    git_in(src.path(), &["config", "user.name", "Tester"])?;
-    std::fs::write(src.path().join("f.txt"), "one\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "one"])?;
-    // A large repository's shape: an imported tier-2 base + ref snapshot, then a push.
-    let id = walgit_git::RepoId::new("o", "r")?;
-    let h = step!("open", server.state.registry.open(&id))?;
-    let c1 = git_in(src.path(), &["rev-parse", "HEAD"])?
-        .trim()
-        .to_string();
-    let packs = tempfile::tempdir()?;
-    let out = std::process::Command::new("git")
-        .current_dir(src.path())
-        .args([
-            "pack-objects",
-            "--revs",
-            &format!("{}/pack", packs.path().display()),
-        ])
-        .stdin(std::process::Stdio::piped())
-        .stdout(std::process::Stdio::piped())
-        .spawn()
-        .and_then(|mut c| {
-            use std::io::Write;
-            c.stdin
-                .take()
-                .unwrap()
-                .write_all(format!("{c1}\n").as_bytes())?;
-            c.wait_with_output()
-        })?;
-    let sha = String::from_utf8_lossy(&out.stdout).trim().to_string();
-    step!("sync0", h.sync())?;
-    step!(
-        "import base",
-        h.add_pack(
-            &packs.path().join(format!("pack-{sha}.pack")),
-            &packs.path().join(format!("pack-{sha}.idx")),
-            2,
-            None
+    let before = handle.manifest();
+    for rebuild_base in [false, true] {
+        let error = walgit_server::ops::compact_repo(
+            &handle,
+            walgit_server::ops::CompactRequest {
+                force: true,
+                rebuild_base,
+            },
+            &walgit_server::ops::noop_log,
         )
-    )?;
-    let txn = walgit_proto::v1::RefTransaction {
-        updates: vec![walgit_proto::v1::RefUpdate {
-            name: "refs/heads/main".into(),
-            old_oid: String::new(),
-            new_oid: c1.clone(),
-            ..Default::default()
-        }],
-        ..Default::default()
-    };
-    step!(
-        "import refs",
-        h.publish_push_synced(None, txn, HashMap::default())
-    )?;
-    std::fs::write(src.path().join("f2.txt"), "one and a half\n")?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "one.5"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    step!("sync", h.sync())?;
-
-    // Passes until idle: base rebuild (base + D18 history pack), weekly compose,
-    // weekly-history compose (of the history pack).
-    for _ in 0..12 {
-        let u = next_unit(&server.state, &id).await?;
-        if u == Unit::Idle {
-            break;
-        }
-        let _ = step!("pass", run_pass(&server.state))?;
+        .await
+        .unwrap_err();
+        assert!(
+            error
+                .to_string()
+                .contains("disabled by the effective repository settings"),
+            "{error:#}"
+        );
     }
-    step!("sync2", h.sync())?;
-    let m = h.manifest();
-    let base = walgit_wal::base_pack(&m).expect("base").clone();
-    let hist = m
-        .packs
-        .iter()
-        .find(|p| {
-            p.kind == walgit_proto::v1::PackKind::History as i32 && p.derived_from == base.checksum
-        })
-        .expect("history pack")
-        .clone();
-    let list = walgit_bundle::ops::read_list(h.store())
-        .await?
-        .expect("list");
-    let weekly = list
-        .bundles
-        .iter()
-        .find(|b| b.strategy == "weekly")
-        .expect("weekly");
-    let weekly_h = list
-        .bundles
-        .iter()
-        .find(|b| b.strategy == "weekly-history")
-        .expect("weekly-history");
-    assert_eq!(weekly.filter, "");
-    assert_eq!(weekly_h.filter, "blob:none");
-    assert!(
-        weekly.size > base.pack_size && weekly.size < base.pack_size + 4096,
-        "weekly = header ∘ base"
-    );
-    assert!(
-        weekly_h.size > hist.pack_size && weekly_h.size < hist.pack_size + 4096,
-        "weekly-history = header ∘ history pack: {} vs {}",
-        weekly_h.size,
-        hist.pack_size
-    );
-    // Header: v3 with the filter capability.
-    let head = server
-        .get_text(
-            &format!("/o/r.git/{}", weekly_h.key),
-            &[("Range", "bytes=0-63")],
-        )
-        .await?;
-    assert!(
-        head.starts_with("# v3 git bundle\n@filter=blob:none\n"),
-        "{head:?}"
-    );
-
-    // A blobless incremental on it ("now" build): new commit with a new blob.
-    std::fs::write(
-        src.path().join("g.txt"),
-        "two — a blob the incremental must NOT carry\n",
-    )?;
-    git_in(src.path(), &["add", "."])?;
-    git_in(src.path(), &["commit", "-q", "-m", "two"])?;
-    git(
-        &["push", "-q", &server.repo_url("o", "r"), "main"],
-        src.path(),
-    )?;
-    step!("sync3", h.sync())?;
-    let inc = step!(
-        "hourly-history build",
-        server.state.bundles.build(&id, "hourly-history")
-    )?;
     assert_eq!(
-        (inc.kind.as_str(), inc.filter.as_str(), inc.base_id.as_str()),
-        ("incremental", "blob:none", weekly_h.id.as_str())
-    );
-    let head = server
-        .get_text(&format!("/o/r.git/{}", inc.key), &[("Range", "bytes=0-63")])
-        .await?;
-    assert!(
-        head.starts_with("# v3 git bundle\n@filter=blob:none\n"),
-        "{head:?}"
-    );
-
-    // Two lists, one family each.
-    let plain = server.get_text("/o/r.git/bundles/list", &[]).await?;
-    let blobless = server
-        .get_text("/o/r.git/bundles/list?filter=blob:none", &[])
-        .await?;
-    assert!(
-        plain.contains("[bundle \"weekly-")
-            && !plain.contains("history")
-            && !plain.contains("filter ="),
-        "{plain}"
-    );
-    assert!(
-        blobless.contains("[bundle \"weekly-history-")
-            && blobless.contains("[bundle \"hourly-history-")
-            && !blobless.contains("[bundle \"weekly-1"),
-        "{blobless}"
-    );
-    assert_eq!(
-        blobless.matches("    filter = blob:none\n").count(),
-        2,
-        "{blobless}"
-    );
-    let v2 = server
-        .state
-        .bundles
-        .protocol_v2_lines(&id, &server.base_url)
-        .await?;
-    assert!(
-        v2.iter().any(|l| l.starts_with("bundle.weekly-1")
-            || l.starts_with("bundle.weekly-") && !l.contains("history"))
-            && !v2.iter().any(|l| l.contains("history")),
-        "{v2:?}"
-    );
-
-    // A blobless clone seeded from the blobless list: promisor packs from the
-    // bundles, blobs missing until checkout fetches them lazily.
-    let tmp = tempfile::tempdir()?;
-    let c = tmp.path().join("blobless");
-    git(
-        &[
-            "clone",
-            "-q",
-            "--filter=blob:none",
-            "--no-checkout",
-            &format!(
-                "--bundle-uri={}/o/r.git/bundles/list?filter=blob:none",
-                server.base_url
-            ),
-            &server.repo_url("o", "r"),
-            c.to_str().unwrap(),
-        ],
-        tmp.path(),
-    )?;
-    let promisors = std::fs::read_dir(c.join(".git/objects/pack"))?
-        .filter(|e| {
-            e.as_ref()
-                .unwrap()
-                .path()
-                .extension()
-                .is_some_and(|x| x == "promisor")
-        })
-        .count();
-    assert!(
-        promisors >= 2,
-        "bundle packs unbundled as promisor packs: {promisors}"
-    );
-    let missing = git_in(&c, &["rev-list", "--objects", "--all", "--missing=print"])?;
-    assert!(
-        missing.lines().any(|l| l.starts_with('?')),
-        "blobs are NOT in the blobless bundles:\n{missing}"
-    );
-    git_in(&c, &["checkout", "-q", "main"])?; // lazy blob fetch from the server
-    assert_eq!(
-        std::fs::read_to_string(c.join("g.txt"))?,
-        "two — a blob the incremental must NOT carry\n"
-    );
-    git_in(&c, &["fsck", "--connectivity-only"])?;
-
-    // A full clone with bundle-uri via the protocol never sees the family.
-    let f = tmp.path().join("full");
-    git(
-        &[
-            "-c",
-            "transfer.bundleURI=true",
-            "clone",
-            "-q",
-            &server.repo_url("o", "r"),
-            f.to_str().unwrap(),
-        ],
-        tmp.path(),
-    )?;
-    let promisors = std::fs::read_dir(f.join(".git/objects/pack"))?
-        .filter(|e| {
-            e.as_ref()
-                .unwrap()
-                .path()
-                .extension()
-                .is_some_and(|x| x == "promisor")
-        })
-        .count();
-    assert_eq!(promisors, 0, "no promisor pack in a full clone");
-    let missing = git_in(&f, &["rev-list", "--objects", "--all", "--missing=print"])?;
-    assert!(!missing.lines().any(|l| l.starts_with('?')), "{missing}");
-    git_in(&f, &["fsck"])?;
-    Ok(())
-}
-
-/// D21 (2026-08-22): the list lists `keep` fulls and the two newest incrementals per
-/// strategy — and the maintainer brings an existing list to that shape on its next pass,
-/// deleting the pruned objects, even when the repository is idle and publishes nothing
-/// (acme/walgit sat at 1 weekly + 3 dailies + 39 hourlies: 43 downloads
-/// per fresh clone).
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn maintainer_pass_brings_an_overgrown_bundle_list_to_retention() -> anyhow::Result<()> {
-    use prost::Message;
-    use walgit_store::{ObjectStore, ObjectStoreExt, PutMode};
-    let server = step!(
-        "start",
-        Server::start_with_tweak(|c| {
-            c.server.roles = vec![walgit_config::Role::Serve, walgit_config::Role::Maintain];
-            c.bundles.enabled = true;
-            // The D21 shape this test pins (the default chains the dailies since 2026-08-22).
-            for s in &mut c.bundles.strategy {
-                s.chain = false;
-            }
-        })
-    )?;
-    step!("put repo", server.put_repo("o", "r"))?;
-    let id = walgit_git::RepoId::new("o", "r")?;
-    let store =
-        walgit_store::Prefixed::new(server.state.registry.store().clone(), id.store_prefix());
-    // Seed: one weekly, three dailies on it, 13 hourlies on each daily (objects = dummy bytes).
-    let mut list = walgit_proto::v1::BundleList {
-        mode: "all".into(),
-        heuristic: "creationToken".into(),
-        ..Default::default()
-    };
-    let entry =
-        |strategy: &str, kind: &str, slot: u64, base_id: &str| walgit_proto::v1::BundleEntry {
-            id: format!("{strategy}-{slot}"),
-            key: format!("bundles/{strategy}/{slot}.bundle"),
-            strategy: strategy.into(),
-            kind: kind.into(),
-            creation_token: slot,
-            slot,
-            base_id: base_id.into(),
-            ..Default::default()
-        };
-    let w0 = 1_787_000_400u64; // a Sunday 23:00-ish epoch; only ordering matters here
-    list.bundles.push(entry("weekly", "full", w0, ""));
-    for d in 1..=3u64 {
-        let ds = w0 + d * 86_400;
-        list.bundles
-            .push(entry("daily", "incremental", ds, &format!("weekly-{w0}")));
-        for h in 1..=13u64 {
-            list.bundles.push(entry(
-                "hourly",
-                "incremental",
-                ds + h * 3600,
-                &format!("daily-{ds}"),
-            ));
-        }
-    }
-    assert_eq!(list.bundles.len(), 43);
-    for b in &list.bundles {
-        step!(
-            "seed object",
-            store.put_bytes(&b.key, b"bundle".as_slice(), PutMode::Create)
-        )?;
-    }
-    step!(
-        "seed list",
-        store.put_bytes(
-            walgit_proto::keys::BUNDLE_LIST,
-            list.encode_to_vec(),
-            PutMode::Create
-        )
-    )?;
-    let text = step!("list before", server.get_text("/o/r.git/bundles/list", &[]))?;
-    assert_eq!(text.matches("uri = ").count(), 43, "{text}");
-
-    // One maintainer pass (whatever unit it picks) applies retention first.
-    let _ = step!("pass", walgit_server::maintain::run_pass(&server.state))?;
-    let after = walgit_bundle::ops::read_list(&store).await?.unwrap();
-    let ids: Vec<&str> = after.bundles.iter().map(|b| b.id.as_str()).collect();
-    assert_eq!(after.bundles.len(), 5, "{ids:?}");
-    let d2 = w0 + 2 * 86_400;
-    let d3 = w0 + 3 * 86_400;
-    for want in [
-        format!("weekly-{w0}"),
-        format!("daily-{d2}"),
-        format!("daily-{d3}"),
-        format!("hourly-{}", d3 + 12 * 3600),
-        format!("hourly-{}", d3 + 13 * 3600),
-    ] {
-        assert!(ids.contains(&want.as_str()), "{want} missing from {ids:?}");
-    }
-    // Pruned objects are gone, kept ones stay.
-    assert!(
-        step!(
-            "pruned gone",
-            store.head(&format!("bundles/hourly/{}.bundle", d2 + 3600))
-        )?
-        .is_none()
-    );
-    assert!(
-        step!(
-            "kept stays",
-            store.head(&format!("bundles/hourly/{}.bundle", d3 + 13 * 3600))
-        )?
-        .is_some()
+        handle.manifest(),
+        before,
+        "disabled requests changed committed state"
     );
-    // Idempotent: a second pass changes nothing.
-    let _ = step!("pass 2", walgit_server::maintain::run_pass(&server.state))?;
-    let again = walgit_bundle::ops::read_list(&store).await?.unwrap();
-    assert_eq!(again.bundles.len(), 5);
     Ok(())
 }
diff --git a/crates/walgit-server/tests/packfile_uri.rs b/crates/walgit-server/tests/packfile_uri.rs
new file mode 100644
index 0000000..30a7e6e
--- /dev/null
+++ b/crates/walgit-server/tests/packfile_uri.rs
@@ -0,0 +1,499 @@
+//! Real pack bytes exercise auth, durable admission, retirement and HTTP ranges.
+mod harness;
+use harness::{Server, TestRepo, git_in};
+use reqwest::StatusCode;
+use walgit_store::{ObjectStoreExt, PutMode};
+
+#[tokio::test]
+async fn missing_coverage_snapshots_share_one_three_read_budget() -> anyhow::Result<()> {
+    use prost::Message;
+    use std::sync::{Arc, atomic::Ordering};
+    use walgit_proto::v1::{PackGroupCoverage, PackRef};
+    let truth = walgit_store::memory::MemoryStore::shared();
+    let link = walgit_store::fault::FaultStore::new(truth.clone(), "selector", 1);
+    let cache = tempfile::tempdir()?;
+    let mut cfg = walgit_config::Config::default();
+    cfg.cache.dir = cache.path().to_owned();
+    cfg.wal.prefetch_packs = false;
+    cfg.wal.freshness_ttl = std::time::Duration::ZERO;
+    let policy = cfg.refs.policy_identity();
+    let registry = walgit_wal::Registry::new(link.clone(), Arc::new(cfg));
+    let id = walgit_git::RepoId::new("o", "budget")?;
+    let handle = registry.create(&id, walgit_git::ObjectFormat::Sha1).await?;
+    let mut manifest = (*handle.manifest()).clone();
+    for n in 1..=5 {
+        let checksum = format!("{n:040x}");
+        manifest.packs.push(PackRef {
+            checksum: checksum.clone(),
+            pack_groups: vec!["code".into()],
+            group_coverages: vec![PackGroupCoverage {
+                group: "code".into(),
+                ref_policy: policy.clone(),
+                refs_key: format!("checkpoints/refs/{n:064x}.pb"),
+                packs: vec![checksum],
+                ..Default::default()
+            }],
+            ..Default::default()
+        });
+    }
+    manifest.revision += 1;
+    truth
+        .put_bytes(
+            &format!("{}manifest.pb", id.store_prefix()),
+            manifest.encode_to_vec(),
+            PutMode::Overwrite,
+        )
+        .await?;
+    drop(handle.sync_refs().await?);
+    let request = walgit_git::UploadPackRequest {
+        done: true,
+        wants: vec![gix_hash::ObjectId::from_hex(
+            b"1111111111111111111111111111111111111111",
+        )?],
+        packfile_uris_protocols: vec!["https".into()],
+        ..Default::default()
+    };
+    let before = link.stats().ops.load(Ordering::Relaxed);
+    assert!(
+        walgit_server::packfile_uri::select(&handle, &request, "https://example.invalid/o/budget")
+            .await
+            .is_none()
+    );
+    assert_eq!(link.stats().ops.load(Ordering::Relaxed) - before, 3);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn blobless_uri_clone_and_dynamic_checkout_work_in_both_object_formats() -> anyhow::Result<()>
+{
+    for (format, name) in [
+        (walgit_config::ObjectFormat::Sha1, "sha1"),
+        (walgit_config::ObjectFormat::Sha256, "sha256"),
+    ] {
+        let server = Server::start_with_tweak(|cfg| {
+            cfg.git.object_format = format;
+            cfg.packfile_uri.uri_min_bytes = bytesize::ByteSize::b(1);
+        })
+        .await?;
+        server.put_repo("o", name).await?;
+        let source = tempfile::tempdir()?;
+        git_in(
+            source.path(),
+            &[
+                "init",
+                "-q",
+                "-b",
+                "main",
+                &format!("--object-format={name}"),
+            ],
+        )?;
+        git_in(source.path(), &["config", "user.name", "Test"])?;
+        git_in(
+            source.path(),
+            &["config", "user.email", "test@example.invalid"],
+        )?;
+        std::fs::write(source.path().join("file.txt"), "lazy blob contents\n")?;
+        git_in(source.path(), &["add", "."])?;
+        git_in(source.path(), &["commit", "-q", "-m", "initial"])?;
+        git_in(
+            source.path(),
+            &["push", "-q", &server.repo_url("o", name), "main"],
+        )?;
+        let handle = server
+            .state
+            .registry
+            .open(&walgit_git::RepoId::new("o", name)?)
+            .await?;
+        walgit_server::ops::compact_repo(
+            &handle,
+            walgit_server::ops::CompactRequest {
+                force: true,
+                rebuild_base: true,
+            },
+            &|_| {},
+        )
+        .await?;
+        walgit_server::ops::compact_repo(
+            &handle,
+            walgit_server::ops::CompactRequest::default(),
+            &|_| {},
+        )
+        .await?;
+        let clone = tempfile::tempdir()?;
+        let output = std::process::Command::new("git")
+            .env("GIT_TRACE_PACKET", "1")
+            .args([
+                "-c",
+                "protocol.version=2",
+                "-c",
+                "fetch.uriProtocols=http,https",
+                "clone",
+                "--progress",
+                "--filter=blob:none",
+                "--no-checkout",
+                &server.repo_url("o", name),
+                clone.path().to_str().unwrap(),
+            ])
+            .output()?;
+        let trace = String::from_utf8_lossy(&output.stderr);
+        assert!(output.status.success(), "{name}: {trace}");
+        assert!(trace.contains("< \\1packfile-uris"), "{name}: {trace}");
+        let missing = git_in(
+            clone.path(),
+            &["rev-list", "--objects", "--all", "--missing=print"],
+        )?;
+        assert!(
+            missing.lines().any(|l| l.starts_with('?')),
+            "static blobless clone must omit blobs: {missing}"
+        );
+        git_in(clone.path(), &["checkout", "-q", "-f", "main"])?;
+        assert_eq!(
+            std::fs::read_to_string(clone.path().join("file.txt"))?,
+            "lazy blob contents\n"
+        );
+        git_in(clone.path(), &["fsck", "--strict"])?;
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn discovery_is_independent_of_pack_groups_and_full_view_preserves_mirrors()
+-> anyhow::Result<()> {
+    let server = Server::start_with_tweak(|cfg| cfg.refs.packfiles.clear()).await?;
+    server.put_repo("o", "refs").await?;
+    let source = TestRepo::synthetic(2, 1)?;
+    let url = server.repo_url("o", "refs");
+    git_in(
+        &source,
+        &[
+            "push",
+            "-q",
+            &url,
+            "main",
+            "HEAD:refs/meta/state",
+            "HEAD:refs/notes/tool",
+        ],
+    )?;
+    for version in ["0", "2"] {
+        let refs = git_in(
+            &source,
+            &[
+                "-c",
+                &format!("protocol.version={version}"),
+                "ls-remote",
+                &url,
+            ],
+        )?;
+        assert!(refs.contains("refs/heads/main"));
+        assert!(!refs.contains("refs/meta/"));
+        assert!(!refs.contains("refs/notes/"));
+    }
+    let refs = git_in(
+        &source,
+        &[
+            "-c",
+            "protocol.version=2",
+            "ls-remote",
+            "--server-option=ref-view=all",
+            "--server-option=extra",
+            &url,
+        ],
+    )?;
+    assert!(refs.contains("refs/meta/state"));
+    assert!(refs.contains("refs/notes/tool"));
+    let clone = tempfile::tempdir()?;
+    git_in(
+        &source,
+        &[
+            "clone",
+            "-q",
+            "--mirror",
+            "--server-option=ref-view=all",
+            &url,
+            clone.path().to_str().unwrap(),
+        ],
+    )?;
+    assert_eq!(
+        git_in(clone.path(), &["rev-parse", "refs/meta/state"])?,
+        git_in(&source, &["rev-parse", "HEAD"])?
+    );
+    git_in(clone.path(), &["fsck", "--strict"])?;
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn stock_git_downloads_static_baseline_and_native_residual_while_gix_stays_dynamic()
+-> anyhow::Result<()> {
+    let server = Server::start_with_tweak(|cfg| {
+        cfg.packfile_uri.uri_min_bytes = bytesize::ByteSize::b(1);
+    })
+    .await?;
+    server.put_repo("o", "delivery").await?;
+    let source = TestRepo::synthetic(4, 3)?;
+    git_in(
+        &source,
+        &["push", "-q", &server.repo_url("o", "delivery"), "main"],
+    )?;
+    git_in(&source, &["checkout", "-q", "--orphan", "metadata"])?;
+    git_in(&source, &["rm", "-q", "-rf", "."])?;
+    std::fs::write(source.join("metadata.txt"), "metadata-only payload\n")?;
+    git_in(&source, &["add", "."])?;
+    git_in(&source, &["commit", "-q", "-m", "metadata"])?;
+    let metadata_tip = git_in(&source, &["rev-parse", "HEAD"])?;
+    git_in(
+        &source,
+        &[
+            "push",
+            "-q",
+            &server.repo_url("o", "delivery"),
+            "HEAD:refs/meta/state",
+        ],
+    )?;
+    git_in(&source, &["checkout", "-q", "main"])?;
+    let id = walgit_git::RepoId::new("o", "delivery")?;
+    let handle = server.state.registry.open(&id).await?;
+    walgit_server::ops::compact_repo(
+        &handle,
+        walgit_server::ops::CompactRequest {
+            force: true,
+            rebuild_base: true,
+        },
+        &|_| {},
+    )
+    .await?;
+    walgit_server::ops::compact_repo(
+        &handle,
+        walgit_server::ops::CompactRequest::default(),
+        &|_| {},
+    )
+    .await?;
+    assert!(
+        handle
+            .manifest()
+            .packs
+            .iter()
+            .any(|p| !p.group_coverages.is_empty())
+    );
+    // The selected snapshot precedes this push: the wire pack must carry its graph.
+    std::fs::write(source.join("after-cut.txt"), "dynamic remainder\n")?;
+    git_in(&source, &["add", "."])?;
+    git_in(&source, &["commit", "-q", "-m", "after cut"])?;
+    git_in(
+        &source,
+        &["push", "-q", &server.repo_url("o", "delivery"), "main"],
+    )?;
+    let tip = git_in(&source, &["rev-parse", "HEAD"])?;
+    for (engine, protected) in [
+        (walgit_config::UploadPackEngine::Git, false),
+        (walgit_config::UploadPackEngine::Gix, false),
+        (walgit_config::UploadPackEngine::Git, true),
+    ] {
+        let front = server
+            .start_sibling_with(|cfg| {
+                cfg.git.upload_pack_engine = engine;
+                cfg.packfile_uri.uri_min_bytes = bytesize::ByteSize::b(1);
+                if protected {
+                    cfg.server.auth.mode = walgit_config::AuthMode::Token;
+                    cfg.server.auth.anonymous_read = false;
+                    cfg.server.auth.tokens = vec![walgit_config::StaticToken {
+                        principal: "reader".into(),
+                        token: "test-reader".into(),
+                        token_env: None,
+                        write: false,
+                        admin: false,
+                    }];
+                }
+            })
+            .await?;
+        let clone = tempfile::tempdir()?;
+        let mut command = std::process::Command::new("git");
+        if protected {
+            command.args(["-c", "http.extraHeader=Authorization: Bearer test-reader"]);
+        }
+        let result = command
+            .env("GIT_TRACE_PACKET", "1")
+            .args([
+                "-c",
+                "protocol.version=2",
+                "-c",
+                "fetch.uriProtocols=http,https",
+                "clone",
+                "--progress",
+                &front.repo_url("o", "delivery"),
+                clone.path().to_str().unwrap(),
+            ])
+            .output()?;
+        let trace = String::from_utf8_lossy(&result.stderr);
+        assert!(result.status.success(), "{engine:?}: {trace}");
+        assert_eq!(
+            trace.contains("< \\1packfile-uris"),
+            engine == walgit_config::UploadPackEngine::Git && !protected,
+            "{trace}"
+        );
+        if protected {
+            assert!(trace.contains("WARNING: reusable pack delivery is unavailable"));
+        }
+        assert_eq!(git_in(clone.path(), &["rev-parse", "HEAD"])?, tip);
+        assert_eq!(
+            std::fs::read_to_string(clone.path().join("after-cut.txt"))?,
+            "dynamic remainder\n"
+        );
+        git_in(clone.path(), &["fsck", "--strict"])?;
+        let metadata = std::process::Command::new("git")
+            .current_dir(clone.path())
+            .args(["cat-file", "-e", metadata_tip.trim()])
+            .output()?;
+        assert!(
+            !metadata.status.success(),
+            "metadata-only commit leaked into ordinary code delivery"
+        );
+    }
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn protected_pack_downloads_require_membership_and_survive_retirement() -> anyhow::Result<()>
+{
+    let writer = Server::start().await?;
+    writer.put_repo("o", "packs").await?;
+    let source = TestRepo::synthetic(3, 2)?;
+    git_in(
+        &source,
+        &["push", "-q", &writer.repo_url("o", "packs"), "main"],
+    )?;
+    let id = walgit_git::RepoId::new("o", "packs")?;
+    let handle = writer.state.registry.open(&id).await?;
+    let checksum = handle.manifest().packs[0].checksum.clone();
+    let protected = writer
+        .start_sibling_with(|cfg| {
+            cfg.server.auth.mode = walgit_config::AuthMode::Token;
+            cfg.server.auth.anonymous_read = false;
+            cfg.server.auth.tokens = vec![walgit_config::StaticToken {
+                principal: "reader".into(),
+                token: "test-reader".into(),
+                token_env: None,
+                write: false,
+                admin: false,
+            }];
+            // Static transfer must not materialize the repository into this cache.
+            cfg.cache.max_bytes = bytesize::ByteSize::b(1);
+        })
+        .await?;
+    let client = reqwest::Client::new();
+    for extension in ["pack", "idx"] {
+        let url = format!(
+            "{}/o/packs.git/packfiles/{checksum}.{extension}",
+            protected.base_url
+        );
+        let full = client.get(&url).bearer_auth("test-reader").send().await?;
+        assert_eq!(full.status(), StatusCode::OK);
+        assert!(
+            full.headers()["cache-control"]
+                .to_str()?
+                .starts_with("private,")
+        );
+        let etag = full.headers()["etag"].to_str()?.to_owned();
+        let bytes = full.bytes().await?;
+        assert!(!bytes.is_empty());
+        let head = client.head(&url).bearer_auth("test-reader").send().await?;
+        assert_eq!(head.status(), StatusCode::OK);
+        assert_eq!(
+            head.headers()["content-length"]
+                .to_str()?
+                .parse::<usize>()?,
+            bytes.len()
+        );
+        assert!(head.bytes().await?.is_empty());
+        for token in [None, Some("invalid")] {
+            let mut req = client.get(&url).header("If-None-Match", &etag);
+            if let Some(token) = token {
+                req = req.bearer_auth(token);
+            }
+            assert_eq!(req.send().await?.status(), StatusCode::UNAUTHORIZED);
+        }
+        assert_eq!(
+            client
+                .get(&url)
+                .bearer_auth("test-reader")
+                .header("If-None-Match", &etag)
+                .send()
+                .await?
+                .status(),
+            StatusCode::NOT_MODIFIED
+        );
+        let partial = client
+            .get(&url)
+            .bearer_auth("test-reader")
+            .header("Range", "bytes=2-8")
+            .header("If-Range", &etag)
+            .send()
+            .await?;
+        assert_eq!(partial.status(), StatusCode::PARTIAL_CONTENT);
+        assert_eq!(partial.bytes().await?, bytes.slice(2..9));
+        let weak = client
+            .get(&url)
+            .bearer_auth("test-reader")
+            .header("Range", "bytes=2-8")
+            .header("If-Range", format!("W/{etag}"))
+            .send()
+            .await?;
+        assert_eq!(weak.status(), StatusCode::OK);
+        assert_eq!(weak.bytes().await?, bytes);
+        assert_eq!(
+            client
+                .get(&url)
+                .bearer_auth("test-reader")
+                .header("Range", "bytes=999999-")
+                .send()
+                .await?
+                .status(),
+            StatusCode::RANGE_NOT_SATISFIABLE
+        );
+        // New outputs commit before the original input leaves the live inventory.
+        if extension == "pack" {
+            walgit_server::ops::compact_repo(
+                &handle,
+                walgit_server::ops::CompactRequest {
+                    force: true,
+                    rebuild_base: true,
+                },
+                &|_| {},
+            )
+            .await?;
+            assert!(
+                handle
+                    .manifest()
+                    .retired_packs
+                    .iter()
+                    .any(|p| p.checksum == checksum)
+            );
+        }
+        let retired = client.get(&url).bearer_auth("test-reader").send().await?;
+        assert_eq!(retired.status(), StatusCode::OK);
+        assert_eq!(retired.bytes().await?, bytes);
+    }
+    let orphan = "f".repeat(40);
+    handle
+        .store()
+        .put_bytes(
+            &format!("wal/{orphan}.pack"),
+            b"uncommitted".to_vec(),
+            PutMode::Create,
+        )
+        .await?;
+    for name in [
+        format!("{orphan}.pack"),
+        format!("{checksum}.rev"),
+        format!("{checksum}.pack/extra"),
+    ] {
+        let response = client
+            .get(format!("{}/o/packs/packfiles/{name}", protected.base_url))
+            .bearer_auth("test-reader")
+            .send()
+            .await?;
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
+    }
+    let cold = protected.state.registry.open(&id).await?;
+    assert!(cold.local().packs()?.is_empty());
+    Ok(())
+}
diff --git a/crates/walgit-server/tests/routing_prefix.rs b/crates/walgit-server/tests/routing_prefix.rs
index 4205666..b359f15 100644
--- a/crates/walgit-server/tests/routing_prefix.rs
+++ b/crates/walgit-server/tests/routing_prefix.rs
@@ -210,7 +210,7 @@ fn repo_prefix_location_regex_semantics() {
         "/acme/monorepo.git/info/refs",
         "/acme/monorepo/api/refs",
         "/acme/monorepo/api-browser/refs",
-        "/acme/monorepo/bundles/weekly/x",
+        "/acme/monorepo/info/lfs/objects/abc",
         "/acme/monorepo/info/lfs/objects/aa",
         "/acme/monorepo/settings",
         "/acme/monorepo/tree/main",
diff --git a/crates/walgit-server/tests/sim.rs b/crates/walgit-server/tests/sim.rs
index 1d6cf93..7998424 100644
--- a/crates/walgit-server/tests/sim.rs
+++ b/crates/walgit-server/tests/sim.rs
@@ -156,8 +156,8 @@ fn sim_config(cache_dir: &Path) -> walgit_config::Config {
     cfg.wal.snapshot_every_entries = 0;
     cfg.wal.checkpoint_interval = Duration::ZERO;
     cfg.wal.checkpoint_tail_bytes = walgit_config::ByteSize::b(0);
-    cfg.compaction.lease_ttl = Duration::from_secs(2);
-    cfg.compaction.trigger_packs = 4;
+    cfg.packs.lease_ttl = Duration::from_secs(2);
+    cfg.packs.fold_when_fresh_packs_reach = 4;
     // The simulator exercises WAL publication, not derived-index CPU work.
     // History-pack/commit-graph builders can dominate tiny zero-latency store
     // runs and obscure the liveness bound without injecting another fault.
@@ -311,48 +311,6 @@ impl Cluster {
     }
 }
 
-/// `BundleSource` adapter used by the bundle-lease liveness scenario.
-struct SimBundleSource(Arc<Registry>);
-
-#[async_trait::async_trait]
-impl walgit_bundle::BundleSource for SimBundleSource {
-    async fn open_repo(
-        &self,
-        id: &RepoId,
-    ) -> Result<walgit_bundle::BundleRepoHandle, walgit_bundle::BundleError> {
-        let h = self
-            .0
-            .open(id)
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?;
-        Ok(walgit_bundle::BundleRepoHandle {
-            local: h.local().clone(),
-            store: h.store().clone(),
-            head_seq: h.manifest().head_seq,
-            engine: walgit_bundle::BundleEngine::Git,
-            cfg: Some(h.effective_config()),
-        })
-    }
-
-    async fn prepare_objects(&self, id: &RepoId) -> Result<(), walgit_bundle::BundleError> {
-        let h = self
-            .0
-            .open(id)
-            .await
-            .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?;
-        drop(
-            h.sync_full()
-                .await
-                .map_err(|e| walgit_bundle::BundleError::Other(e.to_string()))?,
-        );
-        Ok(())
-    }
-
-    async fn list_repos(&self) -> Result<Vec<RepoId>, walgit_bundle::BundleError> {
-        Ok(Vec::new())
-    }
-}
-
 // ---------------------------------------------------------------------------
 // Pushers
 // ---------------------------------------------------------------------------
@@ -530,11 +488,8 @@ async fn check_truth(c: &Cluster, pushers: &[Pusher]) -> Result<()> {
     let prefix = c.repo_prefix();
     let cp_seq = manifest.checkpoint.as_ref().map_or(0, |cp| cp.seq);
     let mut folded: HashMap<String, String> = HashMap::new();
-    if cp_seq > 0 {
-        let key = format!(
-            "{prefix}{}",
-            walgit_proto::keys::checkpoint_refs_key(cp_seq)
-        );
+    if let Some(cp) = &manifest.checkpoint {
+        let key = format!("{prefix}{}", cp.refs_key);
         let (_, b) = c
             .truth
             .get_bytes(&key)
@@ -655,10 +610,7 @@ async fn check_truth(c: &Cluster, pushers: &[Pusher]) -> Result<()> {
         );
     }
     if let Some(cp) = &manifest.checkpoint {
-        for key in [
-            walgit_proto::keys::checkpoint_key(cp.seq),
-            walgit_proto::keys::checkpoint_refs_key(cp.seq),
-        ] {
+        for key in [cp.key.clone(), cp.refs_key.clone()] {
             ensure!(
                 c.truth.exists(&format!("{prefix}{key}")).await?,
                 "checkpoint object missing: {key}"
@@ -779,7 +731,6 @@ async fn check_core_liveness(
             bound,
             walgit_server::ops::compact_repo(
                 &h,
-                &c.instances[core[0]].cfg,
                 walgit_server::ops::CompactRequest {
                     force: true,
                     rebuild_base: false,
@@ -901,12 +852,10 @@ async fn run_safety_then_liveness(seed: u64) -> Result<()> {
             let i = rng.below_usize(n_instances);
             if let Ok(h) = c.instances[i].open(&c.id).await {
                 let _ = tokio::time::timeout(op_timeout, h.write_checkpoint()).await;
-                let cfg = c.instances[i].cfg.clone();
                 let _ = tokio::time::timeout(
                     op_timeout,
                     walgit_server::ops::compact_repo(
                         &h,
-                        &cfg,
                         walgit_server::ops::CompactRequest {
                             force: rng.chance(0.5),
                             rebuild_base: false,
@@ -1046,7 +995,7 @@ async fn liveness_compaction_after_lease_holder_dies() -> Result<()> {
         &walgit_proto::keys::lease_key("compact"),
         "dead-instance",
         "compact",
-        c.instances[1].cfg.compaction.lease_ttl,
+        c.instances[1].cfg.packs.lease_ttl,
     )
     .await?
     .expect("lease free");
@@ -1058,7 +1007,6 @@ async fn liveness_compaction_after_lease_holder_dies() -> Result<()> {
     loop {
         let out = walgit_server::ops::compact_repo(
             &h0,
-            &c.instances[0].cfg,
             walgit_server::ops::CompactRequest {
                 force: true,
                 rebuild_base: false,
@@ -1072,7 +1020,7 @@ async fn liveness_compaction_after_lease_holder_dies() -> Result<()> {
                 ensure!(
                     t.elapsed() < Duration::from_secs(15),
                     "lease of a dead holder never expired (ttl {:?})",
-                    c.instances[0].cfg.compaction.lease_ttl
+                    c.instances[0].cfg.packs.lease_ttl
                 );
                 tokio::time::sleep(Duration::from_millis(200)).await;
             }
@@ -1325,7 +1273,6 @@ async fn liveness_orphaned_log_segment_does_not_block_writers() -> Result<()> {
     let h = c.instances[0].open(&c.id).await?;
     let out = walgit_server::ops::compact_repo(
         &h,
-        &c.instances[0].cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: false,
@@ -1405,7 +1352,6 @@ async fn liveness_cold_start_through_truncated_pack_reads() -> Result<()> {
     // Compaction on the healed instance works on what it downloaded.
     let out = walgit_server::ops::compact_repo(
         &h,
-        &c.instances[cold].cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: false,
@@ -1480,7 +1426,6 @@ async fn liveness_black_holed_instance_is_invisible_to_the_core() -> Result<()>
         Duration::from_secs(20),
         walgit_server::ops::compact_repo(
             &h,
-            &c.instances[0].cfg,
             walgit_server::ops::CompactRequest {
                 force: true,
                 rebuild_base: false,
@@ -1578,12 +1523,10 @@ async fn liveness_checkpoint_racing_compaction() -> Result<()> {
     let h0 = c.instances[0].open(&c.id).await?;
     let h1 = c.instances[1].open(&c.id).await?;
     drop(h1.sync_full().await?);
-    let cfg = c.instances[1].cfg.clone();
     let (cp, compact) = tokio::join!(
         h0.write_checkpoint(),
         walgit_server::ops::compact_repo(
             &h1,
-            &cfg,
             walgit_server::ops::CompactRequest {
                 force: true,
                 rebuild_base: false
@@ -1603,53 +1546,6 @@ async fn liveness_checkpoint_racing_compaction() -> Result<()> {
     Ok(())
 }
 
-/// The due-bundle lease is durable, so a dead holder leaves it behind. Once
-/// its expiry passes, a healthy maintainer must steal it and build the bundle.
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn liveness_bundle_build_after_lease_holder_dies() -> Result<()> {
-    let mut c = Cluster::new(21, 1).await?;
-    let mut p = Pusher::new(0);
-    ensure!(
-        p.push_once(&c.instances[0], &c.id, Duration::from_secs(10))
-            .await?
-    );
-    let maint = c.add_instance("bundle-core", &|cfg| {
-        cfg.bundles.strategy.truncate(1); // weekly/full only
-        // The sim pushes to refs/heads/p<idx>, never main; with the D22 default
-        // `bundles.main_only = true` a weekly of this repo has no refs to cut
-        // (`NoRefs`) — the test was silently failing since that default landed
-        // (2026-08-21 ~22:00Z). Bundle every head here; the liveness under test
-        // is the lease, not the ref selection.
-        cfg.bundles.main_only = false;
-    });
-    let h = c.instances[maint].open(&c.id).await?;
-    let dead =
-        walgit_bundle::ops::try_acquire_lease(h.store(), "weekly", Duration::from_millis(100))
-            .await?
-            .expect("setup: weekly lease free");
-    std::mem::forget(dead);
-
-    let source = Arc::new(SimBundleSource(c.instances[maint].registry.clone()));
-    let bundler = walgit_bundle::Bundler::new_with_source(source, c.instances[maint].cfg.clone());
-    ensure!(
-        bundler
-            .run_due(&c.id, std::time::SystemTime::now())
-            .await?
-            .is_empty(),
-        "built while dead holder's lease was live"
-    );
-    tokio::time::sleep(Duration::from_millis(120)).await;
-    let built = tokio::time::timeout(
-        Duration::from_secs(20),
-        bundler.run_due(&c.id, std::time::SystemTime::now()),
-    )
-    .await
-    .map_err(|_| anyhow!("bundle build did not recover after lease expiry"))??;
-    ensure!(built.iter().any(|b| b.strategy == "weekly"));
-    check_truth(&c, std::slice::from_ref(&p)).await?;
-    Ok(())
-}
-
 /// Exact healthy-link request counts defend the critical-path budgets in
 /// docs/ROUNDTRIPS.md. `MemoryStore` has no retries, so deltas are deterministic:
 /// push = one freshness GET + pack/idx/log PUTs + manifest CAS; warm refs = one
@@ -1689,7 +1585,7 @@ async fn healthy_request_round_trip_budgets() -> Result<()> {
     // Checkpoint: the freshness GET every operation pays, then refs PUT ∥ checkpoint PUT, then
     // the manifest CAS — 4 requests, 3 rounds; the provenance times come from what the writer
     // already applied, never a log GET (2026-08-22: it was 6 requests in 6 rounds with a
-    // bundle-list GET and a log GET inside).
+    // unnecessary store reads inside).
     let before = c.instances[0].link.stats().ops.load(Ordering::Relaxed);
     let cp = h.write_checkpoint().await?;
     let cp_ops = c.instances[0].link.stats().ops.load(Ordering::Relaxed) - before;
@@ -1707,228 +1603,6 @@ async fn healthy_request_round_trip_budgets() -> Result<()> {
     Ok(())
 }
 
-// ---------------------------------------------------------------------------
-// Bundle list: two maintainers (one legacy-shaped) + retention under faults
-// ---------------------------------------------------------------------------
-
-fn sim_bundle_entry(
-    strategy: &str,
-    kind: &str,
-    slot: u64,
-    base_id: &str,
-) -> walgit_proto::v1::BundleEntry {
-    walgit_proto::v1::BundleEntry {
-        id: format!("{strategy}-{slot}"),
-        key: format!("bundles/{strategy}/{slot}.bundle"),
-        strategy: strategy.into(),
-        kind: kind.into(),
-        creation_token: slot,
-        slot,
-        base_id: base_id.into(),
-        ..Default::default()
-    }
-}
-
-/// Oracle over the truth store: every bundle the *current* list references exists (a client
-/// that just read the list never 404s on an entry), and — once converged — the list obeys the
-/// D21 rule (`keep` fulls + the 2 newest incrementals per strategy, no orphan).
-async fn check_bundle_list_truth(c: &Cluster, converged: bool) -> Result<()> {
-    let store = walgit_store::Prefixed::new(c.truth.clone(), c.repo_prefix());
-    let Some(list) = walgit_bundle::ops::read_list(&store).await? else {
-        return Ok(());
-    };
-    for b in &list.bundles {
-        ensure!(
-            c.truth
-                .head(&format!("{}{}", c.repo_prefix(), b.key))
-                .await?
-                .is_some(),
-            "listed bundle {} is missing from the bucket (a client would 404)",
-            b.key
-        );
-        if !b.base_id.is_empty() {
-            ensure!(
-                list.bundles.iter().any(|x| x.id == b.base_id),
-                "orphan {}: base {} not listed",
-                b.id,
-                b.base_id
-            );
-        }
-    }
-    if converged {
-        let mut probe = list.clone();
-        let pruned = walgit_bundle::slots::retain(
-            &sim_config(Path::new("/nonexistent")).bundles,
-            &mut probe,
-        );
-        ensure!(
-            pruned.is_empty(),
-            "list not at retention: would still prune {pruned:?}"
-        );
-        for strat in ["daily", "hourly"] {
-            ensure!(
-                list.bundles.iter().filter(|b| b.strategy == strat).count()
-                    <= walgit_bundle::slots::INCREMENTALS_KEPT,
-                "{strat}: more than {} listed",
-                walgit_bundle::slots::INCREMENTALS_KEPT
-            );
-        }
-    }
-    Ok(())
-}
-
-/// A legacy-shaped maintainer (the rule before 2026-08-22: publish = append, prune nothing) and a
-/// current one race on `bundles/list.pb` through faulty links (lost responses, spurious 412s,
-/// errors before the op) while an oracle watches the truth. The list must converge to the D21
-/// rule within a bounded number of healthy passes, no listed bundle may ever be missing, and a
-/// steady-state retention pass costs one request (ROUNDTRIPS: 0 extra when nothing is pruned).
-async fn run_bundle_retention_race(seed: u64) -> Result<()> {
-    let mut c = Cluster::new(seed, 1).await?;
-    let store = walgit_store::Prefixed::new(c.truth.clone(), c.repo_prefix());
-    // Seed: one weekly, two dailies on it, 8 hourlies on each daily (objects = dummy bytes).
-    let mut list = walgit_proto::v1::BundleList {
-        mode: "all".into(),
-        heuristic: "creationToken".into(),
-        ..Default::default()
-    };
-    let w0 = 1_787_000_400u64;
-    list.bundles
-        .push(sim_bundle_entry("weekly", "full", w0, ""));
-    let mut slot_max = w0;
-    for d in 1..=2u64 {
-        let ds = w0 + d * 86_400;
-        list.bundles.push(sim_bundle_entry(
-            "daily",
-            "incremental",
-            ds,
-            &format!("weekly-{w0}"),
-        ));
-        for h in 1..=8u64 {
-            list.bundles.push(sim_bundle_entry(
-                "hourly",
-                "incremental",
-                ds + h * 3600,
-                &format!("daily-{ds}"),
-            ));
-            slot_max = slot_max.max(ds + h * 3600);
-        }
-    }
-    for b in &list.bundles {
-        store
-            .put_bytes(&b.key, b"bundle".as_slice(), walgit_store::PutMode::Create)
-            .await?;
-    }
-    store
-        .put_bytes(
-            walgit_proto::keys::BUNDLE_LIST,
-            list.encode_to_vec(),
-            walgit_store::PutMode::Create,
-        )
-        .await?;
-    check_bundle_list_truth(&c, false).await?;
-
-    // The current maintainer (faulty link) and the legacy one (its own faulty link).
-    let cur = c.add_instance("maint-current", &|cfg| cfg.bundles.enabled = true);
-    let legacy = c.add_instance("maint-legacy", &|cfg| cfg.bundles.enabled = true);
-    let chaos = FaultPlan::chaos(0.15).with_only(&["bundles/"]);
-    c.instances[cur].link.set(chaos.clone());
-    c.instances[legacy].link.set(chaos);
-    let bundler = walgit_bundle::Bundler::new_with_source(
-        Arc::new(SimBundleSource(c.instances[cur].registry.clone())),
-        c.instances[cur].cfg.clone(),
-    );
-    let legacy_h = c.instances[legacy].open(&c.id).await?;
-    let legacy_store = legacy_h.store().clone();
-    let newest_daily = format!("daily-{}", w0 + 2 * 86_400);
-
-    // Safety mode: interleave retention passes with legacy appends (each new hourly's object is
-    // written first, then the list entry — the legacy code's order too), checking the oracle.
-    let mut appended = 0u64;
-    for round in 0..12u64 {
-        let _ = bundler.apply_retention(&c.id).await; // faults may fail it: that is the point
-        if round % 2 == 0 {
-            slot_max += 3600;
-            let e = sim_bundle_entry("hourly", "incremental", slot_max, &newest_daily);
-            if legacy_store
-                .put_bytes(&e.key, b"bundle".as_slice(), walgit_store::PutMode::Create)
-                .await
-                .is_ok()
-            {
-                let e2 = e.clone();
-                let r = walgit_bundle::ops::cas_update_list(&legacy_store, 8, move |cur| {
-                    let mut l = cur.cloned().unwrap_or_default();
-                    l.bundles.retain(|b| b.id != e2.id);
-                    l.bundles.push(e2.clone());
-                    Ok(Some(l))
-                })
-                .await;
-                if r.is_ok() {
-                    appended += 1;
-                }
-            }
-        }
-        check_bundle_list_truth(&c, false)
-            .await
-            .with_context(|| format!("round {round}, seed {seed}\n{}", c.dump_traces()))?;
-    }
-
-    // Liveness mode: heal the current maintainer; the list converges within a bound.
-    c.instances[cur].link.heal();
-    let mut converged = false;
-    for _ in 0..6 {
-        bundler.apply_retention(&c.id).await?;
-        if check_bundle_list_truth(&c, true).await.is_ok() {
-            converged = true;
-            break;
-        }
-    }
-    ensure!(
-        converged,
-        "list did not converge to retention (seed {seed}, legacy appended {appended}):\n{}",
-        c.dump_traces()
-    );
-    // Steady state: a retention pass with nothing to prune is one request (the list GET).
-    let before = c.instances[cur].link.stats().ops.load(Ordering::Relaxed);
-    ensure!(bundler.apply_retention(&c.id).await? == 0);
-    let ops = c.instances[cur].link.stats().ops.load(Ordering::Relaxed) - before;
-    ensure!(
-        ops <= 1,
-        "steady-state retention pass used {ops} requests, budget 1"
-    );
-    // And a legacy append after convergence is folded by the next pass, never leaving a gap.
-    slot_max += 3600;
-    let e = sim_bundle_entry("hourly", "incremental", slot_max, &newest_daily);
-    c.instances[legacy].link.heal();
-    legacy_store
-        .put_bytes(&e.key, b"bundle".as_slice(), walgit_store::PutMode::Create)
-        .await?;
-    let e2 = e.clone();
-    walgit_bundle::ops::cas_update_list(&legacy_store, 8, move |cur| {
-        let mut l = cur.cloned().unwrap_or_default();
-        l.bundles.push(e2.clone());
-        Ok(Some(l))
-    })
-    .await?;
-    check_bundle_list_truth(&c, false).await?;
-    bundler.apply_retention(&c.id).await?;
-    check_bundle_list_truth(&c, true).await?;
-    let final_list = walgit_bundle::ops::read_list(&store).await?.unwrap();
-    ensure!(
-        final_list.bundles.iter().any(|b| b.id == e.id),
-        "the newest legacy hourly is listed"
-    );
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
-async fn sim_bundle_retention_under_two_maintainers() {
-    for seed in seeds() {
-        run_bundle_retention_race(seed)
-            .await
-            .unwrap_or_else(|e| panic!("seed {seed}: {e:#}"));
-    }
-}
-
 // ---------------------------------------------------------------------------
 // Checkpoint writer crashes between its PUTs and the manifest CAS
 // ---------------------------------------------------------------------------
@@ -1982,10 +1656,7 @@ async fn run_checkpoint_crash(seed: u64, crash_at: &str) -> Result<()> {
     let m = c.truth_manifest().await?;
     ensure!(m.checkpoint.as_ref().map(|x| x.seq) == Some(before.head_seq));
     // The committed checkpoint's objects exist and a cold start folds from it.
-    for key in [
-        walgit_proto::keys::checkpoint_key(cp.seq),
-        walgit_proto::keys::checkpoint_refs_key(cp.seq),
-    ] {
+    for key in [cp.key.clone(), cp.refs_key.clone()] {
         ensure!(
             c.truth
                 .head(&format!("{}{}", c.repo_prefix(), key))
@@ -2026,6 +1697,11 @@ fn pack_objects(repo: &Path, checksum: &gix_hash::ObjectId) -> std::collections:
         .args(["verify-pack", "-v", idx.to_str().unwrap()])
         .output()
         .unwrap();
+    assert!(
+        out.status.success(),
+        "verify-pack failed: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
     String::from_utf8_lossy(&out.stdout)
         .lines()
         .filter_map(|l| {
@@ -2057,7 +1733,6 @@ async fn seed_base_and_history(
     drop(h.sync_full().await?);
     let out = walgit_server::ops::compact_repo(
         &h,
-        &c.instances[i].cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: true,
@@ -2122,19 +1797,38 @@ async fn geometric_fold_never_touches_the_base_or_the_history_pack() -> Result<(
         .map(|x| x.checksum.clone())
         .collect();
     ensure!(fresh.len() >= 2, "{before:?}");
+    let mut expected_inventory = std::collections::HashSet::new();
+    for pack in &before.packs {
+        expected_inventory.extend(pack_objects(
+            h.local().path(),
+            &gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?,
+        ));
+    }
     let base_objects = pack_objects(h.local().path(), &base);
     ensure!(!base_objects.is_empty());
 
-    let out = walgit_server::ops::compact_repo(
-        &h,
-        &c.instances[i].cfg,
-        walgit_server::ops::CompactRequest {
-            force: true,
-            rebuild_base: false,
-        },
-        &walgit_server::ops::noop_log,
-    )
-    .await?;
+    // Classification and mixed-pack separation are independent bounded units.
+    // Keep running them until the compatible fresh family is actually folded.
+    let mut folded = None;
+    for _ in 0..16 {
+        let outcome = walgit_server::ops::compact_repo(
+            &h,
+            walgit_server::ops::CompactRequest {
+                force: true,
+                rebuild_base: false,
+            },
+            &walgit_server::ops::noop_log,
+        )
+        .await?;
+        if matches!(
+            outcome,
+            walgit_server::ops::CompactOutcome::Published { tier: 1, .. }
+        ) {
+            folded = Some(outcome);
+            break;
+        }
+    }
+    let out = folded.ok_or_else(|| anyhow!("no compatible family folded within 16 units"))?;
     let dbg = format!("{out:?}");
     let walgit_server::ops::CompactOutcome::Published {
         rebuild_base,
@@ -2170,16 +1864,20 @@ async fn geometric_fold_never_touches_the_base_or_the_history_pack() -> Result<(
             .any(|x| x.checksum == hist.to_hex().to_string()
                 && x.kind == walgit_proto::v1::PackKind::History as i32)
     );
-    for f in &fresh {
-        ensure!(
-            !live.contains(&f.as_str()),
-            "fresh pack {f} still live after the fold"
-        );
+    ensure!(
+        superseded >= 2,
+        "fold needs at least two compatible inputs: {dbg}"
+    );
+    let mut actual_inventory = std::collections::HashSet::new();
+    for pack in &after.packs {
+        actual_inventory.extend(pack_objects(
+            h.local().path(),
+            &gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?,
+        ));
     }
     ensure!(
-        superseded == fresh.len(),
-        "superseded {superseded}, fresh {}",
-        fresh.len()
+        actual_inventory == expected_inventory,
+        "fold changed committed object inventory"
     );
     // The folded pack carries none of the base's objects.
     for new in &packs {
@@ -2226,7 +1924,6 @@ async fn full_rebuild_leaves_exactly_one_base_even_with_a_retained_pack() -> Res
     let log_lines: std::sync::Mutex<Vec<String>> = std::sync::Mutex::new(Vec::new());
     let out = walgit_server::ops::compact_repo(
         &h,
-        &c.instances[i].cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: true,
@@ -2269,7 +1966,10 @@ async fn full_rebuild_leaves_exactly_one_base_even_with_a_retained_pack() -> Res
             // The rebuild may reproduce an identical pack (same objects, same order): then it is the
             // new base, never a stale extra.
             ensure!(
-                fulls[0].checksum == *old,
+                after
+                    .packs
+                    .iter()
+                    .any(|pack| pack.checksum == *old && pack.tier == 2),
                 "old pack {old} still live next to the new base: {after:?}"
             );
         }
@@ -2284,7 +1984,7 @@ async fn full_rebuild_leaves_exactly_one_base_even_with_a_retained_pack() -> Res
 }
 
 // ---------------------------------------------------------------------------
-// Resumable base rebuild (BUNDLE_URI_DESIGN §5a)
+// Resumable isolated pack cuts
 // ---------------------------------------------------------------------------
 
 /// Run one rebuild attempt; returns (outcome, log lines).
@@ -2299,7 +1999,6 @@ async fn rebuild_attempt(
     };
     let out = walgit_server::ops::compact_repo(
         &h,
-        &c.instances[i].cfg,
         walgit_server::ops::CompactRequest {
             force: true,
             rebuild_base: true,
@@ -2310,20 +2009,15 @@ async fn rebuild_attempt(
     (out, lines.into_inner().unwrap())
 }
 
-/// A deploy (D31) kills the rebuild after any phase: the next unit resumes from the marker —
-/// across every phase boundary there is exactly **one** `git repack` in total — the serving copy
-/// is never rewritten (its pack files before publish are exactly the pre-rebuild ones), and the
-/// result is one base + one history pack. A push between the attempts makes the head move, and
-/// the next unit starts over (a second repack) instead of publishing a pack that lacks objects.
+/// Interrupted isolated cuts preserve the serving inventory and all committed
+/// objects. A changed ref snapshot rejects scratch from the previous cut.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 #[allow(clippy::many_single_char_names)]
 async fn base_rebuild_resumes_after_a_kill_between_any_two_phases() -> Result<()> {
-    use walgit_server::rebuild::{Phase, TEST_ABORT_AFTER};
+    use walgit_server::pack_lifecycle::{Phase, TEST_ABORT_AFTER};
     let mut c = Cluster::new(33, 1).await?;
     let i = c.add_instance("ssd", &|cfg| {
         cfg.cache.mode = walgit_config::CacheMode::Disk;
-        cfg.git.history_pack = true;
-        cfg.git.commit_graph = true;
     });
     let mut p = Pusher::new(0);
     for _ in 0..4 {
@@ -2334,144 +2028,106 @@ async fn base_rebuild_resumes_after_a_kill_between_any_two_phases() -> Result<()
     }
     let h = c.instances[i].open(&c.id).await?;
     drop(h.sync_full().await?);
+    let before = h.manifest();
     let before_files: std::collections::BTreeSet<String> =
         std::fs::read_dir(h.local().path().join("objects/pack"))?
             .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
             .collect();
+    let mut expected = std::collections::HashSet::new();
+    for pack in &before.packs {
+        expected.extend(pack_objects(
+            h.local().path(),
+            &gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?,
+        ));
+    }
     let repo_key = c.id.to_string();
-    let mut repacks = 0usize;
-    // Kill after each phase in turn; every attempt but the last fails by the hook.
-    for phase in [
-        Phase::Copied,
-        Phase::Repacked,
-        Phase::HistoryPack,
-        Phase::CommitGraph,
-    ] {
+    for phase in [Phase::Prepared, Phase::Step] {
         *TEST_ABORT_AFTER.lock() = Some((repo_key.clone(), phase));
         let (out, log) = rebuild_attempt(&c, i).await;
-        repacks += log.iter().filter(|l| l.starts_with("repack done")).count();
         ensure!(
             out.is_err(),
-            "attempt killed after {phase:?} should fail: {out:?}\n{}",
+            "attempt killed after {phase:?}: {out:?}\n{}",
             log.join("\n")
         );
-        // The serving copy is untouched while the rebuild is in flight.
         let now_files: std::collections::BTreeSet<String> =
             std::fs::read_dir(h.local().path().join("objects/pack"))?
                 .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
                 .collect();
         ensure!(
             now_files == before_files,
-            "serving copy changed during the rebuild after {phase:?}: {now_files:?} vs {before_files:?}"
+            "serving files changed before publication"
+        );
+        ensure!(
+            h.manifest().packs == before.packs,
+            "inputs changed before final seal"
         );
-        // "Restart": a fresh instance on the same cache dir/link name — the scratch dir on "disk" survives.
-        c.restart_keep_disk(i, &|cfg| {
-            cfg.cache.mode = walgit_config::CacheMode::Disk;
-            cfg.git.history_pack = true;
-            cfg.git.commit_graph = true;
-        });
+        c.restart_keep_disk(i, &|cfg| cfg.cache.mode = walgit_config::CacheMode::Disk);
     }
     *TEST_ABORT_AFTER.lock() = None;
     let (out, log) = rebuild_attempt(&c, i).await;
-    repacks += log.iter().filter(|l| l.starts_with("repack done")).count();
-    let out = out.with_context(|| log.join("\n"))?;
-    ensure!(
-        matches!(
-            out,
-            walgit_server::ops::CompactOutcome::Published {
-                rebuild_base: true,
-                ..
-            }
-        ),
-        "{out:?}"
-    );
-    ensure!(
-        repacks == 1,
-        "exactly one git repack across all attempts, saw {repacks}:\n{}",
-        log.join("\n")
-    );
+    ensure!(matches!(
+        out.with_context(|| log.join("\n"))?,
+        walgit_server::ops::CompactOutcome::Published {
+            rebuild_base: true,
+            ..
+        }
+    ));
     ensure!(
-        log.iter().any(|l| l.starts_with("resuming base rebuild")),
+        log.iter()
+            .any(|line| line.contains("resumed validated pack lifecycle progress")),
         "{}",
         log.join("\n")
     );
     let h = c.instances[i].open(&c.id).await?;
     drop(h.sync_full().await?);
-    let m = h.manifest();
-    ensure!(
-        m.packs
-            .iter()
-            .filter(|x| x.tier == 2 && x.kind != walgit_proto::v1::PackKind::History as i32)
-            .count()
-            == 1,
-        "{m:?}"
-    );
-    ensure!(
-        m.packs
-            .iter()
-            .filter(|x| x.kind == walgit_proto::v1::PackKind::History as i32)
-            .count()
-            == 1,
-        "{m:?}"
-    );
-    ensure!(m.packs.len() == 2, "{m:?}");
-    let scratch = c.instances[i].cfg.cache.dir.join("_rebuild");
+    let mut actual = std::collections::HashSet::new();
+    for pack in &h.manifest().packs {
+        actual.extend(pack_objects(
+            h.local().path(),
+            &gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?,
+        ));
+    }
     ensure!(
-        !scratch.join("sim").exists() || std::fs::read_dir(scratch.join("sim"))?.next().is_none(),
-        "scratch dir left behind"
+        actual == expected,
+        "cut changed the committed object inventory"
     );
     check_truth(&c, std::slice::from_ref(&p)).await?;
 
-    // A push between a kill and the resume: the head moved, the next attempt starts over.
-    *TEST_ABORT_AFTER.lock() = Some((repo_key.clone(), Phase::Repacked));
-    let (out, log1) = rebuild_attempt(&c, i).await;
+    *TEST_ABORT_AFTER.lock() = Some((repo_key.clone(), Phase::Step));
+    let (out, _) = rebuild_attempt(&c, i).await;
     ensure!(out.is_err());
-    ensure!(log1.iter().filter(|l| l.starts_with("repack done")).count() == 1);
     ensure!(
         p.push_once(&c.instances[i], &c.id, Duration::from_secs(10))
             .await?
     );
     *TEST_ABORT_AFTER.lock() = None;
-    let (out, log2) = rebuild_attempt(&c, i).await;
-    let out = out.with_context(|| log2.join("\n"))?;
+    let (out, log) = rebuild_attempt(&c, i).await;
     ensure!(matches!(
-        out,
+        out.with_context(|| log.join("\n"))?,
         walgit_server::ops::CompactOutcome::Published {
             rebuild_base: true,
             ..
         }
     ));
     ensure!(
-        log2.iter()
-            .any(|l| l.starts_with("discarding interrupted base rebuild")),
+        log.iter()
+            .any(|line| line.starts_with("scratch cannot resume")),
         "{}",
-        log2.join("\n")
-    );
-    ensure!(
-        log2.iter().filter(|l| l.starts_with("repack done")).count() == 1,
-        "a fresh repack after the head moved"
+        log.join("\n")
     );
     let h = c.instances[i].open(&c.id).await?;
     drop(h.sync_full().await?);
-    let m = h.manifest();
-    ensure!(
-        m.packs.len() == 2,
-        "one base + one history pack again: {m:?}"
-    );
-    // The pushed commit is in the new base (not lost to a stale scratch).
-    let base = m
-        .packs
-        .iter()
-        .find(|x| x.tier == 2 && x.kind != walgit_proto::v1::PackKind::History as i32)
-        .unwrap();
-    let objs = pack_objects(
-        h.local().path(),
-        &gix_hash::ObjectId::from_hex(base.checksum.as_bytes())?,
-    );
+    let mut actual = std::collections::HashSet::new();
+    for pack in &h.manifest().packs {
+        actual.extend(pack_objects(
+            h.local().path(),
+            &gix_hash::ObjectId::from_hex(pack.checksum.as_bytes())?,
+        ));
+    }
+    ensure!(actual.contains(&p.tip), "the in-between push was lost");
     ensure!(
-        objs.contains(&p.tip),
-        "the in-between push's tip {} is in the new base",
-        p.tip
+        expected.is_subset(&actual),
+        "previously committed objects were lost"
     );
     check_truth(&c, std::slice::from_ref(&p)).await?;
     Ok(())
@@ -2871,3 +2527,43 @@ async fn sim_cache_pressure_keeps_pinned_repos_and_refuses_too_large() {
 
 #[allow(dead_code)]
 fn _unused(_: WalError) {}
+
+/// A prepared older checkpoint cannot replace a newer checkpoint after another
+/// push advances head beyond both. Sequence equality with current head is not enough.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn checkpoint_retry_never_regresses_a_newer_checkpoint() -> Result<()> {
+    let c = Cluster::new(63, 2).await?;
+    let mut p = Pusher::new(0);
+    ensure!(
+        p.push_once(&c.instances[0], &c.id, Duration::from_secs(10))
+            .await?
+    );
+    let old = c.instances[0].open(&c.id).await?;
+    let old_seq = old.manifest().head_seq;
+    let gate = c.instances[0].link.gate_next("put", "checkpoint.pb");
+    let pending = tokio::spawn(async move { old.write_checkpoint().await });
+    tokio::time::timeout(Duration::from_secs(10), gate.entered()).await?;
+
+    ensure!(
+        p.push_once(&c.instances[1], &c.id, Duration::from_secs(10))
+            .await?
+    );
+    let newer = c.instances[1].open(&c.id).await?;
+    let checkpoint = newer.write_checkpoint().await?;
+    ensure!(checkpoint.seq > old_seq);
+    ensure!(
+        p.push_once(&c.instances[1], &c.id, Duration::from_secs(10))
+            .await?
+    );
+    ensure!(c.truth_manifest().await?.head_seq > checkpoint.seq);
+
+    gate.release();
+    let observed = tokio::time::timeout(Duration::from_secs(10), pending).await???;
+    ensure!(
+        observed == checkpoint,
+        "old writer did not adopt the newer checkpoint"
+    );
+    ensure!(c.truth_manifest().await?.checkpoint == Some(checkpoint));
+    check_truth(&c, std::slice::from_ref(&p)).await?;
+    Ok(())
+}
diff --git a/crates/walgit-server/tests/static_http.rs b/crates/walgit-server/tests/static_http.rs
index ed7f015..895acfa 100644
--- a/crates/walgit-server/tests/static_http.rs
+++ b/crates/walgit-server/tests/static_http.rs
@@ -1,4 +1,4 @@
-//! HTTP contract of immutable store objects (LFS here; bundles share the same
+//! HTTP contract of immutable store objects (LFS exercises the shared
 //! `static_object` path) and of the embedded UI assets: strong `ETags`, 304,
 //! Range/If-Range, HEAD, Content-Length, precompressed encodings.
 
diff --git a/crates/walgit-server/tests/web_ui.rs b/crates/walgit-server/tests/web_ui.rs
index 81cb64d..3b1e677 100644
--- a/crates/walgit-server/tests/web_ui.rs
+++ b/crates/walgit-server/tests/web_ui.rs
@@ -100,7 +100,6 @@ async fn overview_reports_push_and_unknown_repo_is_text_404() -> Result<()> {
     assert_eq!(body["repo"], "o/r");
     assert!(body["manifest"]["next_seq"].as_u64().unwrap() >= 2);
     assert!(body["packs"]["pushes"].as_u64().unwrap() >= 1);
-    assert!(body["bundles"].is_array());
     assert!(body["compactions"].is_array());
 
     let missing = client
diff --git a/crates/walgit-store/src/fault.rs b/crates/walgit-store/src/fault.rs
index 47df311..a3e9574 100644
--- a/crates/walgit-store/src/fault.rs
+++ b/crates/walgit-store/src/fault.rs
@@ -190,6 +190,23 @@ pub struct FaultStore {
     /// Patterns from `panic_once_keys` already fired.
     fired_panics: Mutex<Vec<String>>,
     trace: Mutex<Option<Vec<String>>>,
+    gate: Mutex<Option<(String, String, Arc<OperationGate>)>>,
+}
+
+/// Deterministically pause one operation before it touches the truth store.
+#[derive(Default)]
+pub struct OperationGate {
+    entered: tokio::sync::Notify,
+    release: tokio::sync::Notify,
+}
+
+impl OperationGate {
+    pub async fn entered(&self) {
+        self.entered.notified().await;
+    }
+    pub fn release(&self) {
+        self.release.notify_one();
+    }
 }
 
 enum Decision {
@@ -213,6 +230,7 @@ impl FaultStore {
             stats: Stats::default(),
             fired_panics: Mutex::new(Vec::new()),
             trace: Mutex::new(None),
+            gate: Mutex::new(None),
         })
     }
     pub fn name(&self) -> &str {
@@ -224,6 +242,12 @@ impl FaultStore {
     pub fn stats(&self) -> &Stats {
         &self.stats
     }
+    /// Gate the next matching operation; the key argument is a substring.
+    pub fn gate_next(&self, op: &str, key: &str) -> Arc<OperationGate> {
+        let gate = Arc::new(OperationGate::default());
+        *self.gate.lock() = Some((op.into(), key.into(), gate.clone()));
+        gate
+    }
     /// Replace the plan (takes effect for every op issued from now on).
     pub fn set(&self, plan: FaultPlan) {
         *self.plan.lock() = plan;
@@ -278,6 +302,21 @@ impl FaultStore {
         conditional: bool,
         read_body: bool,
     ) -> Decision {
+        let gate = {
+            let mut pending = self.gate.lock();
+            if pending
+                .as_ref()
+                .is_some_and(|(operation, pattern, _)| operation == op && key.contains(pattern))
+            {
+                pending.take().map(|(_, _, gate)| gate)
+            } else {
+                None
+            }
+        };
+        if let Some(gate) = gate {
+            gate.entered.notify_one();
+            gate.release.notified().await;
+        }
         self.stats.ops.fetch_add(1, Ordering::Relaxed);
         let plan = self.plan.lock().clone();
         if let Some(p) = plan
diff --git a/crates/walgit-store/src/gcs.rs b/crates/walgit-store/src/gcs.rs
index 8e7d68c..fbe4a62 100644
--- a/crates/walgit-store/src/gcs.rs
+++ b/crates/walgit-store/src/gcs.rs
@@ -244,20 +244,14 @@ impl GcsStore {
         reason = "Object store control keys use exact case-sensitive suffixes"
     )]
     fn is_bulk_key(key: &str) -> bool {
-        // Pack data + side-files, bundle *files* (not `bundles/list.pb`), LFS
-        // objects. Everything else — manifest, log, checkpoints, leases,
-        // bundle list, policy — is control plane and must never wait for a
-        // bulk permit (prod 2026-08-20: `bundles/list.pb` (753 B) classified
-        // bulk sat 455–472 s behind 32 stripes on the bulk semaphore while
-        // info/refs waited for it).
+        // Packs and LFS are bulk; manifests, logs, checkpoints, leases and policy
+        // stay on the control transport even during a large transfer.
         let name = key.rsplit('/').next().unwrap_or(key);
         if name.ends_with(".pb") || name.ends_with(".json") {
             return false;
         }
         key.contains("/wal/")
             || key.starts_with("wal/")
-            || key.contains("/bundles/")
-            || key.starts_with("bundles/")
             || key.contains("/lfs/")
             || key.starts_with("lfs/")
     }
@@ -1493,7 +1487,6 @@ mod bulk_key_tests {
             "prefix/repos/o/r/log/0000000000000001.pb",
             "prefix/repos/o/r/checkpoints/0000000000000001/refs.pb",
             "prefix/repos/o/r/leases/compact.pb",
-            "prefix/repos/o/r/bundles/list.pb",
             "prefix/repos/o/r/policy.json",
             "prefix/repos/o/r/cache/api/v1/abc.json",
         ] {
@@ -1503,7 +1496,6 @@ mod bulk_key_tests {
             "prefix/repos/o/r/wal/abc.pack",
             "prefix/repos/o/r/wal/abc.idx",
             "prefix/repos/o/r/wal/abc.commit-graph",
-            "prefix/repos/o/r/bundles/weekly/2026-abc.bundle",
             "prefix/repos/o/r/lfs/objects/ab/cd/abcd",
         ] {
             assert!(GcsStore::is_bulk_key(k), "{k} must be bulk");
diff --git a/crates/walgit-store/tests/contract.rs b/crates/walgit-store/tests/contract.rs
index 768b860..fb516ff 100644
--- a/crates/walgit-store/tests/contract.rs
+++ b/crates/walgit-store/tests/contract.rs
@@ -895,7 +895,7 @@ async fn gcs_control_plane_not_starved_by_bulk() {
         if let Some(repo_root) = big_key.rsplit_once("/wal/").map(|(a, _)| a) {
             for small in [
                 format!("{repo_root}/manifest.pb"),
-                format!("{repo_root}/bundles/list.pb"),
+                format!("{repo_root}/policy.json"),
             ] {
                 let t = std::time::Instant::now();
                 let _ = store.get(&small, GetOptions::default()).await;
diff --git a/crates/walgit-wal/Cargo.toml b/crates/walgit-wal/Cargo.toml
index 1272af1..9fdda34 100644
--- a/crates/walgit-wal/Cargo.toml
+++ b/crates/walgit-wal/Cargo.toml
@@ -31,6 +31,7 @@ gix-pack.workspace = true
 gix-object.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+toml.workspace = true
 moka = { workspace = true, features = ["future"] }
 flate2.workspace = true
 chrono.workspace = true
diff --git a/crates/walgit-wal/src/checkpoint.rs b/crates/walgit-wal/src/checkpoint.rs
index edad910..5834c20 100644
--- a/crates/walgit-wal/src/checkpoint.rs
+++ b/crates/walgit-wal/src/checkpoint.rs
@@ -6,7 +6,7 @@ use std::sync::Arc;
 use prost::Message;
 use walgit_proto::keys;
 use walgit_proto::time;
-use walgit_proto::v1::{Checkpoint, CheckpointRef, Manifest, RefSnapshot};
+use walgit_proto::v1::{Checkpoint, CheckpointRef, Manifest};
 use walgit_store::{ObjectStore, PutBody, PutMode, PutOptions, StoreError};
 
 use crate::error::WalError;
@@ -115,8 +115,8 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
     let max_retries = handle.cfg.wal.cas_max_retries;
 
     // Sync to get current state (refs only; packs are taken from the manifest).
-    handle.sync_impl_level(crate::sync::SyncLevel::Refs).await?;
-    let manifest = handle.manifest.read().clone();
+    let view = handle.publication_view().await?;
+    let manifest = &view.manifest;
 
     // If checkpoint already at head, return it (idempotent)
     if let Some(ref cp) = manifest.checkpoint
@@ -138,10 +138,10 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
     }
 
     // Build refs snapshot from local repo
-    let refs_data = handle.local.refs()?;
-    let snap: RefSnapshot = refs_data.into();
-    let refs_key = keys::checkpoint_refs_key(seq);
-    let snap_bytes = snap.encode_to_vec();
+    let snap = &view.refs;
+    let snap_bytes =
+        walgit_proto::snapshot::encode(snap).map_err(|e| WalError::Corrupt(e.to_string()))?;
+    let refs_key = walgit_proto::snapshot::key(&snap_bytes);
 
     // Provenance for the slot planner (D22): the earliest state ever (carried forward) and the
     // time of the newest folded entry — from what this writer already applied (`first_entry_time`
@@ -164,7 +164,7 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
 
     // The checkpoint: the pack set with its side-file inventory (idx/rev/bitmap/commit-graph
     // flags travel in PackRef) + the ref snapshot. `bundle_key` is left empty: nothing reads it
-    // (`import --direct` still fills it), and looking the list up cost a round trip.
+    // and no bundle object is consulted.
     let checkpoint = Checkpoint {
         seq,
         object_format: manifest.object_format.clone(),
@@ -178,22 +178,18 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
         created_at: Some(created_at),
         writer: writer.clone(),
     };
-    let cp_key = keys::checkpoint_key(seq);
+    let cp_key = keys::checkpoint_attempt_key(seq, &uuid::Uuid::new_v4().to_string());
     let cp_bytes = checkpoint.encode_to_vec();
 
-    // Round 1: both immutable objects in parallel. Keyed by seq and deterministic for a given
-    // state, so a writer that dies here leaves garbage, never a hazard (sim
+    // Round 1: both immutable objects in parallel. Content-addressed refs and attempt-unique metadata, so a writer that dies here leaves garbage, never a hazard (sim
     // `sim_checkpoint_writer_crash_is_invisible_and_repaired`).
     let immutable = PutOptions {
+        mode: PutMode::Create,
         immutable: true,
         ..Default::default()
     };
     let (r_refs, r_cp) = tokio::join!(
-        handle.store.put(
-            &refs_key,
-            PutBody::Bytes(bytes::Bytes::from(snap_bytes)),
-            immutable.clone()
-        ),
+        crate::snapshots::put_snapshot(&handle.store, &refs_key, snap_bytes),
         handle.store.put(
             &cp_key,
             PutBody::Bytes(bytes::Bytes::from(cp_bytes)),
@@ -209,17 +205,17 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
         created_at: Some(created_at),
         first_state_at,
         as_of,
+        refs_key,
     };
 
     // Round 2: CAS manifest: set checkpoint, min_seq = seq+1, trim log_segments
     let mut attempts = 0u32;
     loop {
-        let current_manifest = handle.manifest.read().clone();
-        let known_version = handle.manifest_version.lock().clone();
+        let (current_manifest, known_version) = handle.manifest_pair();
 
         // If checkpoint already at or past head, done
         if let Some(ref cp) = current_manifest.checkpoint
-            && cp.seq >= current_manifest.head_seq
+            && cp.seq >= seq
         {
             return Ok(cp.clone());
         }
@@ -249,8 +245,10 @@ async fn write_checkpoint_inner(handle: &RepoHandle) -> Result<CheckpointRef, Wa
             .await
         {
             Ok(meta) => {
-                *handle.manifest.write() = Arc::new(updated.clone());
-                *handle.manifest_version.lock() = Some(meta.version.clone());
+                let _sync = handle.sync_mutex.lock().await;
+                if !handle.adopt_manifest(Arc::new(updated.clone()), meta.version.clone()) {
+                    return Ok(cp_ref);
+                }
                 {
                     let mut state = handle.state.lock();
                     state.manifest_version = Some(meta.version.as_str().to_string());
diff --git a/crates/walgit-wal/src/classification.rs b/crates/walgit-wal/src/classification.rs
new file mode 100644
index 0000000..637b77b
--- /dev/null
+++ b/crates/walgit-wal/src/classification.rs
@@ -0,0 +1,574 @@
+//! Metadata publication for already committed packs. Graph closure/conservation
+//! starts with the producer; final retirement also verifies indexed conservation
+//! and current-tip membership against each captured CAS basis.
+use crate::{CoverageSnapshot, RepoHandle, WalError};
+use prost::Message;
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::Arc;
+use walgit_proto::v1::{Manifest, PackAudience, PackGroupCoverage, PackKind, PackRef};
+use walgit_store::{ObjectStore, PutBody, PutMode, StoreError};
+
+#[derive(Clone, Debug, Default, PartialEq)]
+pub struct PackClassification {
+    pub checksum: String,
+    pub kind: i32,
+    pub audience: i32,
+    pub ref_policy: String,
+    pub pack_groups: Vec<String>,
+    pub covers_seq: u64,
+    pub coverage_refs_key: String,
+    pub group_coverages: Vec<PackGroupCoverage>,
+}
+
+impl PackClassification {
+    pub fn from_pack(pack: &PackRef) -> Self {
+        Self {
+            checksum: pack.checksum.clone(),
+            kind: pack.kind,
+            audience: pack.audience,
+            ref_policy: pack.ref_policy.clone(),
+            pack_groups: pack.pack_groups.clone(),
+            covers_seq: pack.covers_seq,
+            coverage_refs_key: pack.coverage_refs_key.clone(),
+            group_coverages: pack.group_coverages.clone(),
+        }
+    }
+
+    pub(crate) fn apply(&self, pack: &mut PackRef) {
+        pack.kind = self.kind;
+        pack.audience = self.audience;
+        pack.ref_policy.clone_from(&self.ref_policy);
+        pack.pack_groups.clone_from(&self.pack_groups);
+        pack.covers_seq = self.covers_seq;
+        pack.coverage_refs_key.clone_from(&self.coverage_refs_key);
+        pack.group_coverages.clone_from(&self.group_coverages);
+    }
+}
+
+fn invalid(message: impl Into<String>) -> WalError {
+    WalError::Invalid(message.into())
+}
+
+fn audience_matches(
+    pack: &PackRef,
+    kind: walgit_config::PackGroupKind,
+    cfg: &walgit_config::Config,
+) -> bool {
+    let code = pack.pack_groups.iter().any(|name| {
+        cfg.refs
+            .packfiles
+            .get(name)
+            .is_some_and(|g| g.kind == walgit_config::PackGroupKind::Code)
+    });
+    match kind {
+        walgit_config::PackGroupKind::Code => pack.audience == PackAudience::Code as i32,
+        walgit_config::PackGroupKind::Meta => {
+            pack.audience
+                == if code {
+                    PackAudience::Code as i32
+                } else {
+                    PackAudience::Meta as i32
+                }
+        }
+    }
+}
+
+/// Removing/reclassifying inputs revokes surviving certificates that no longer
+/// describe a complete set. It does not delete their packs or rewrite bytes.
+pub(crate) fn prune_invalid_coverages(
+    manifest: &mut Manifest,
+    cfg: &walgit_config::Config,
+    changed: &[String],
+) {
+    let policy = cfg.refs.policy_identity();
+    loop {
+        let before = manifest.clone();
+        let mut removed = false;
+        for carrier in &mut manifest.packs {
+            if changed.contains(&carrier.checksum) {
+                continue;
+            }
+            carrier.group_coverages.retain(|proof| {
+                let valid = proof.ref_policy == policy
+                    && cfg.refs.packfiles.get(&proof.group).is_some_and(|group| {
+                        !proof.packs.is_empty()
+                            && proof.packs.iter().all(|id| {
+                                before.packs.iter().any(|p| {
+                                    p.checksum == *id
+                                        && p.pack_groups.contains(&proof.group)
+                                        && p.ref_policy == policy
+                                        && p.covers_seq == proof.covers_seq
+                                        && p.coverage_refs_key == proof.refs_key
+                                })
+                            })
+                            && group.subtract.iter().all(|dependency| {
+                                before
+                                    .packs
+                                    .iter()
+                                    .flat_map(|p| &p.group_coverages)
+                                    .any(|c| {
+                                        c.group == *dependency
+                                            && c.ref_policy == policy
+                                            && c.covers_seq == proof.covers_seq
+                                            && c.refs_key == proof.refs_key
+                                    })
+                            })
+                    });
+                removed |= !valid;
+                valid
+            });
+        }
+        if !removed {
+            break;
+        }
+    }
+}
+
+/// One validator for COMPACT and metadata CAS attempts. Candidates have no
+/// authority before this CAS; existing snapshot keys must already be committed.
+pub(crate) async fn validate_certificates(
+    handle: &RepoHandle,
+    before: &Manifest,
+    after: &Manifest,
+    changed: &[String],
+    candidates: &[CoverageSnapshot],
+) -> Result<(), WalError> {
+    let cfg = handle.validated_config_for_manifest(before)?;
+    let policy = cfg.refs.policy_identity();
+    let live: BTreeMap<&str, &PackRef> = after
+        .packs
+        .iter()
+        .map(|p| (p.checksum.as_str(), p))
+        .collect();
+    let proofs: Vec<&PackGroupCoverage> = after
+        .packs
+        .iter()
+        .flat_map(|p| &p.group_coverages)
+        .collect();
+    let mut validated = BTreeSet::new();
+    let mut snapshots: BTreeMap<String, walgit_proto::v1::RefSnapshot> = BTreeMap::new();
+    for checksum in changed {
+        let pack = live
+            .get(checksum.as_str())
+            .ok_or_else(|| invalid("classified pack is no longer live"))?;
+        if PackKind::try_from(pack.kind).is_err() || PackAudience::try_from(pack.audience).is_err()
+        {
+            return Err(invalid("unknown pack classification"));
+        }
+        let unique: BTreeSet<_> = pack.pack_groups.iter().collect();
+        if unique.len() != pack.pack_groups.len() {
+            return Err(invalid("duplicate pack group"));
+        }
+        for group in &pack.pack_groups {
+            if group == "_retained" {
+                if pack.audience != PackAudience::Retained as i32
+                    || !pack.group_coverages.is_empty()
+                {
+                    return Err(invalid("retained packs cannot carry group coverage"));
+                }
+                continue;
+            }
+            let definition = cfg
+                .refs
+                .packfiles
+                .get(group)
+                .ok_or_else(|| invalid(format!("unknown pack group {group}")))?;
+            if pack.ref_policy != policy || !audience_matches(pack, definition.kind, &cfg) {
+                return Err(invalid(
+                    "pack classification has stale policy or wrong audience",
+                ));
+            }
+        }
+        for coverage in &pack.group_coverages {
+            if !pack.pack_groups.contains(&coverage.group)
+                || pack.coverage_refs_key != coverage.refs_key
+                || !coverage.packs.contains(&pack.checksum)
+            {
+                return Err(invalid("coverage carrier is outside its certificate"));
+            }
+            let mut pending = vec![coverage];
+            while let Some(proof) = pending.pop() {
+                if !validated.insert((
+                    proof.group.clone(),
+                    proof.covers_seq,
+                    proof.refs_key.clone(),
+                    proof.packs.clone(),
+                )) {
+                    continue;
+                }
+                if proof.ref_policy != policy
+                    || proof.covers_seq > before.head_seq
+                    || proof.refs_key.is_empty()
+                {
+                    return Err(invalid("coverage policy or captured generation is invalid"));
+                }
+                let definition = cfg
+                    .refs
+                    .packfiles
+                    .get(&proof.group)
+                    .ok_or_else(|| invalid("coverage names an unknown group"))?;
+                let members: BTreeSet<_> = proof.packs.iter().collect();
+                if members.is_empty() || members.len() != proof.packs.len() {
+                    return Err(invalid("coverage members are empty or duplicated"));
+                }
+                for member in &proof.packs {
+                    let p = live
+                        .get(member.as_str())
+                        .ok_or_else(|| invalid(format!("coverage member {member} is not live")))?;
+                    if !p.pack_groups.contains(&proof.group)
+                        || p.ref_policy != policy
+                        || p.covers_seq != proof.covers_seq
+                        || p.coverage_refs_key != proof.refs_key
+                    {
+                        return Err(invalid("coverage member scope changed"));
+                    }
+                    if !audience_matches(p, definition.kind, &cfg) {
+                        return Err(invalid("coverage member audience changed"));
+                    }
+                }
+                let snapshot = if let Some(cached) = snapshots.get(&proof.refs_key) {
+                    cached.clone()
+                } else if let Some(candidate) = candidates.iter().find(|s| s.key == proof.refs_key)
+                {
+                    if candidate.repo != before.repo {
+                        return Err(invalid("coverage candidate belongs to another repository"));
+                    }
+                    candidate.snapshot.clone()
+                } else {
+                    let committed = before
+                        .packs
+                        .iter()
+                        .flat_map(|p| &p.group_coverages)
+                        .any(|p| p.refs_key == proof.refs_key && p.covers_seq == proof.covers_seq)
+                        || before.checkpoint.as_ref().is_some_and(|cp| {
+                            cp.refs_key == proof.refs_key && cp.seq == proof.covers_seq
+                        });
+                    if !committed {
+                        return Err(invalid(
+                            "coverage snapshot is not committed or supplied by its producer",
+                        ));
+                    }
+                    crate::snapshots::read_snapshot(
+                        &handle.store,
+                        &proof.refs_key,
+                        proof.covers_seq,
+                        &before.object_format,
+                    )
+                    .await?
+                };
+                snapshots.insert(proof.refs_key.clone(), snapshot.clone());
+                if snapshot.seq != proof.covers_seq
+                    || snapshot.object_format != before.object_format
+                {
+                    return Err(invalid("coverage snapshot generation mismatch"));
+                }
+                for dependency in &definition.subtract {
+                    let dependency_proof = proofs
+                        .iter()
+                        .find(|p| {
+                            p.group == *dependency
+                                && p.covers_seq == proof.covers_seq
+                                && p.refs_key == proof.refs_key
+                                && p.ref_policy == policy
+                        })
+                        .ok_or_else(|| {
+                            invalid(format!(
+                                "missing same-generation coverage for dependency {dependency}"
+                            ))
+                        })?;
+                    if proofs.iter().any(|p| {
+                        p.group == *dependency
+                            && p.covers_seq == proof.covers_seq
+                            && p.refs_key == proof.refs_key
+                            && p.ref_policy == policy
+                            && p.packs != dependency_proof.packs
+                    }) {
+                        return Err(invalid("conflicting dependency coverage"));
+                    }
+                    pending.push(*dependency_proof);
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+impl RepoHandle {
+    /// Reclassify a bounded batch without changing WAL sequence or pack bytes.
+    /// Every retry proves membership and policy against its fresh CAS basis.
+    pub async fn reclassify_packs(
+        &self,
+        changes: &[PackClassification],
+        candidates: &[CoverageSnapshot],
+    ) -> Result<(), WalError> {
+        if changes.is_empty() {
+            return Ok(());
+        }
+        if changes.len() > 128 || candidates.len() > 128 {
+            return Err(invalid("classification batch exceeds 128"));
+        }
+        let ids: Vec<_> = changes.iter().map(|c| c.checksum.clone()).collect();
+        if ids.iter().collect::<BTreeSet<_>>().len() != ids.len() {
+            return Err(invalid("duplicate classification checksum"));
+        }
+        for attempt in 0..self.cfg.wal.cas_max_retries {
+            self.sync_impl_level(crate::SyncLevel::Refs).await?;
+            let (current, version) = self.manifest_pair();
+            let mut updated = (*current).clone();
+            for change in changes {
+                let pack = updated
+                    .packs
+                    .iter_mut()
+                    .find(|p| p.checksum == change.checksum)
+                    .ok_or_else(|| invalid("classification input was retired"))?;
+                change.apply(pack);
+            }
+            let cfg = self.validated_config_for_manifest(&current)?;
+            prune_invalid_coverages(&mut updated, &cfg, &ids);
+            validate_certificates(self, &current, &updated, &ids, candidates).await?;
+            updated.revision += 1;
+            updated.updated_at = Some(walgit_proto::time::now());
+            updated.writer = crate::handle::instance_id();
+            let mode = version.map_or(PutMode::Create, PutMode::Update);
+            match self
+                .store
+                .put(
+                    walgit_proto::keys::MANIFEST,
+                    PutBody::Bytes(updated.encode_to_vec().into()),
+                    mode.into(),
+                )
+                .await
+            {
+                Ok(meta) => {
+                    let _sync = self.sync_mutex.lock().await;
+                    if self.adopt_manifest(Arc::new(updated.clone()), meta.version.clone()) {
+                        let mut state = self.state.lock();
+                        state.manifest_version = Some(meta.version.as_str().to_string());
+                        state.revision = updated.revision;
+                    }
+                    return Ok(());
+                }
+                Err(StoreError::PreconditionFailed { .. }) => {
+                    tokio::time::sleep(std::time::Duration::from_millis(
+                        5 + u64::from(attempt) * 7,
+                    ))
+                    .await;
+                }
+                Err(e) => return Err(e.into()),
+            }
+        }
+        Err(WalError::Retry {
+            attempts: self.cfg.wal.cas_max_retries,
+        })
+    }
+}
+
+impl RepoHandle {
+    /// Complete a conserving multi-output replacement. Outputs must already be
+    /// committed; until this CAS, all original inputs remain live. The producer
+    /// validates raw links; the seal independently checks indexed conservation
+    /// and all captured current tips before each CAS attempt.
+    pub async fn seal_pack_replacement(
+        &self,
+        captured: &crate::PublicationView,
+        inputs: &[String],
+        outputs: &[PackRef],
+        snapshots: &[CoverageSnapshot],
+        lease: &tokio::sync::Mutex<walgit_store::coord::LeaseGuard>,
+    ) -> Result<u64, WalError> {
+        use crate::publish::{ClaimOutcome, claim_log_slot, drop_own_slot, sweep_burned};
+        use walgit_proto::v1::{EntryKind, LogEntry, LogSegmentRef};
+        use walgit_proto::{frame, keys, time};
+        if inputs.is_empty() || outputs.is_empty() || inputs.len() > 4096 || outputs.len() > 4096 {
+            return Err(invalid(
+                "replacement needs bounded, nonempty input/output sets",
+            ));
+        }
+        if captured.manifest.repo != self.id.to_string() {
+            return Err(invalid("replacement input belongs to another repository"));
+        }
+        let output_ids: Vec<_> = outputs.iter().map(|p| p.checksum.clone()).collect();
+        if inputs.iter().collect::<BTreeSet<_>>().len() != inputs.len()
+            || output_ids.iter().collect::<BTreeSet<_>>().len() != output_ids.len()
+        {
+            return Err(invalid("duplicate replacement input/output"));
+        }
+        let retire: Vec<_> = inputs
+            .iter()
+            .filter(|id| !output_ids.contains(id))
+            .cloned()
+            .collect();
+        for attempt in 0..self.cfg.wal.cas_max_retries {
+            lease
+                .lock()
+                .await
+                .heartbeat(captured.config.packs.lease_ttl)
+                .await
+                .map_err(|e| invalid(format!("replacement lease: {e}")))?;
+            let view = self.publication_view().await?;
+            let current = view.manifest;
+            let version = view.version;
+            let cfg = self.validated_config_for_manifest(&current)?;
+            if cfg.refs.policy_identity() != captured.config.refs.policy_identity() {
+                return Err(invalid("packing policy changed during replacement"));
+            }
+            // Recovery after a lost successful final response. Exact outputs
+            // and retirement, not a local ledger, witness the already-sealed job.
+            if !retire.is_empty()
+                && retire.iter().all(|id| {
+                    current.retired_packs.iter().any(|p| p.checksum == *id)
+                        && !current.packs.iter().any(|p| p.checksum == *id)
+                })
+                && outputs.iter().all(|out| {
+                    current.packs.iter().any(|p| {
+                        PackClassification::from_pack(p) == PackClassification::from_pack(out)
+                            && p.tier == out.tier
+                            && p.derived_from == out.derived_from
+                            && same_pack_bytes(p, out)
+                    })
+                })
+            {
+                return Ok(current.head_seq);
+            }
+            for id in inputs {
+                let original = captured
+                    .manifest
+                    .packs
+                    .iter()
+                    .find(|p| p.checksum == *id)
+                    .ok_or_else(|| invalid("replacement input was never captured"))?;
+                let live = current
+                    .packs
+                    .iter()
+                    .find(|p| p.checksum == *id)
+                    .ok_or_else(|| invalid("replacement input retired during work"))?;
+                if PackClassification::from_pack(original) != PackClassification::from_pack(live)
+                    || original.derived_from != live.derived_from
+                    || original.tier != live.tier
+                    || !same_pack_bytes(original, live)
+                {
+                    return Err(invalid("replacement input scope changed during work"));
+                }
+            }
+            let mut updated = (*current).clone();
+            for out in outputs {
+                let pack = updated
+                    .packs
+                    .iter_mut()
+                    .find(|p| p.checksum == out.checksum)
+                    .ok_or_else(|| invalid("replacement output is not committed"))?;
+                if !same_pack_bytes(pack, out) {
+                    return Err(invalid("replacement output descriptor changed"));
+                }
+                PackClassification::from_pack(out).apply(pack);
+                pack.tier = out.tier;
+                pack.derived_from.clone_from(&out.derived_from);
+                if pack.published_at.is_none() {
+                    pack.published_at = Some(time::now());
+                }
+            }
+            // Validate before claiming a log slot: incomplete outputs never
+            // create even an orphan retirement record.
+            let prospective_seq = current.head_seq.saturating_add(1);
+            updated.retire_packs(&retire, prospective_seq);
+            updated.packs.retain(|p| !retire.contains(&p.checksum));
+            prune_invalid_coverages(&mut updated, &cfg, &output_ids);
+            validate_certificates(self, &current, &updated, &output_ids, snapshots).await?;
+            crate::closure::verify_replacement_inventory(
+                self, &current, &updated, &view.refs, inputs, outputs,
+            )
+            .await?;
+            let at = time::now();
+            let slot = match claim_log_slot(&self.store, current.head_seq, |seq| {
+                let entry = LogEntry {
+                    seq,
+                    kind: EntryKind::Compact as i32,
+                    supersedes: retire.clone(),
+                    created_at: Some(at),
+                    writer: crate::handle::instance_id(),
+                    ..Default::default()
+                };
+                frame::encode_entries(std::iter::once(&entry))
+            })
+            .await?
+            {
+                ClaimOutcome::Claimed(slot) => slot,
+                ClaimOutcome::Contended => continue,
+            };
+            let seq = slot.first_seq;
+            for retired in &mut updated.retired_packs {
+                if retire.contains(&retired.checksum)
+                    && !current
+                        .retired_packs
+                        .iter()
+                        .any(|p| p.checksum == retired.checksum)
+                {
+                    retired.retired_seq = seq;
+                }
+            }
+            updated.head_seq = seq;
+            updated.revision += 1;
+            updated.updated_at = Some(at);
+            updated.writer = crate::handle::instance_id();
+            updated.log_segments.push(LogSegmentRef {
+                key: slot.key.clone(),
+                first_seq: seq,
+                last_seq: seq,
+                size: slot.bytes.len() as u64,
+                sealed: true,
+            });
+            let mode = version.map_or(PutMode::Create, PutMode::Update);
+            let result = self
+                .store
+                .put(
+                    keys::MANIFEST,
+                    PutBody::Bytes(updated.encode_to_vec().into()),
+                    mode.into(),
+                )
+                .await;
+            let committed = match result {
+                Ok(meta) => Some((updated, meta.version)),
+                Err(StoreError::PreconditionFailed { .. }) => None,
+                Err(error) => match crate::publish::cas_landed(&self.store, &slot).await? {
+                    Some(pair) => Some(pair),
+                    None => return Err(error.into()),
+                },
+            };
+            if let Some((committed, version)) = committed {
+                let _sync = self.sync_mutex.lock().await;
+                let applied = self.state.lock().applied_seq;
+                if committed.head_seq > seq && applied < committed.head_seq {
+                    crate::sync::apply_delta(self, &committed, &version).await?;
+                }
+                if self.adopt_manifest(Arc::new(committed.clone()), version.clone()) {
+                    let mut state = self.state.lock();
+                    state.manifest_version = Some(version.as_str().to_string());
+                    state.applied_seq = committed.head_seq;
+                    state.revision = committed.revision;
+                    for id in &retire {
+                        if !state.pending_pack_removals.contains(id) {
+                            state.pending_pack_removals.push(id.clone());
+                        }
+                    }
+                }
+                sweep_burned(&self.store, &slot).await;
+                return Ok(seq);
+            }
+            drop_own_slot(&self.store, &slot).await;
+            tokio::time::sleep(std::time::Duration::from_millis(5 + u64::from(attempt) * 7)).await;
+        }
+        Err(WalError::Retry {
+            attempts: self.cfg.wal.cas_max_retries,
+        })
+    }
+}
+
+fn same_pack_bytes(left: &PackRef, right: &PackRef) -> bool {
+    left.checksum == right.checksum
+        && left.pack_size == right.pack_size
+        && left.idx_size == right.idx_size
+        && left.object_count == right.object_count
+        && left.has_rev == right.has_rev
+        && left.has_bitmap == right.has_bitmap
+        && left.has_commit_graph == right.has_commit_graph
+}
diff --git a/crates/walgit-wal/src/closure.rs b/crates/walgit-wal/src/closure.rs
new file mode 100644
index 0000000..67ce96c
--- /dev/null
+++ b/crates/walgit-wal/src/closure.rs
@@ -0,0 +1,135 @@
+//! Exact indexed inventory checks. Local readability and retired membership are
+//! not publication evidence. Callers bind these mappings to their CAS snapshot.
+use std::cmp::Reverse;
+use std::collections::BinaryHeap;
+
+use gix_hash::ObjectId;
+use walgit_proto::v1::{Manifest, PackRef, RefSnapshot};
+
+use crate::{RepoHandle, WalError, progress::Reporter};
+
+/// Merge sorted index OIDs with one cursor per pack, never a set per object.
+struct IndexUnion<'a> {
+    indexes: Vec<&'a gix_pack::index::File>,
+    cursors: BinaryHeap<Reverse<(ObjectId, usize, u32)>>,
+    previous: Option<ObjectId>,
+}
+impl<'a> IndexUnion<'a> {
+    fn new(indexes: Vec<&'a gix_pack::index::File>) -> Self {
+        let cursors = indexes
+            .iter()
+            .enumerate()
+            .filter(|(_, index)| index.num_objects() > 0)
+            .map(|(i, index)| Reverse((index.oid_at_index(0).to_owned(), i, 0)))
+            .collect();
+        Self {
+            indexes,
+            cursors,
+            previous: None,
+        }
+    }
+}
+impl Iterator for IndexUnion<'_> {
+    type Item = ObjectId;
+    #[allow(
+        clippy::indexing_slicing,
+        reason = "Heap positions come only from enumeration of the immutable index vector"
+    )]
+    fn next(&mut self) -> Option<Self::Item> {
+        while let Some(Reverse((oid, pack, position))) = self.cursors.pop() {
+            let index = self.indexes[pack];
+            if position + 1 < index.num_objects() {
+                self.cursors.push(Reverse((
+                    index.oid_at_index(position + 1).to_owned(),
+                    pack,
+                    position + 1,
+                )));
+            }
+            if self.previous != Some(oid) {
+                self.previous = Some(oid);
+                return Some(oid);
+            }
+        }
+        None
+    }
+}
+
+pub(crate) async fn verify_replacement_inventory(
+    handle: &RepoHandle,
+    current: &Manifest,
+    result: &Manifest,
+    refs: &RefSnapshot,
+    inputs: &[String],
+    outputs: &[PackRef],
+) -> Result<(), WalError> {
+    let reporter = Reporter::for_repo(handle.progress.clone());
+    reporter.notice("Verifying replacement object conservation and current tips");
+    let indexes = crate::index_cache::load(
+        &handle.store,
+        handle.local.path(),
+        &current.packs,
+        &current.packs,
+        handle.local.object_format().kind(),
+        &reporter,
+    )
+    .await?;
+    let inputs = inputs.to_vec();
+    let outputs: Vec<_> = outputs.iter().map(|p| p.checksum.clone()).collect();
+    let retained: Vec<_> = result.packs.iter().map(|p| p.checksum.clone()).collect();
+    let refs = refs.clone();
+    tokio::task::spawn_blocking(move || {
+        let input_indexes = indexes
+            .iter()
+            .filter(|(p, _)| inputs.contains(&p.checksum))
+            .map(|(_, i)| i)
+            .collect();
+        let output_indexes = indexes
+            .iter()
+            .filter(|(p, _)| outputs.contains(&p.checksum))
+            .map(|(_, i)| i)
+            .collect();
+        let mut output_objects = IndexUnion::new(output_indexes).peekable();
+        let mut checked = 0u64;
+        for oid in IndexUnion::new(input_indexes) {
+            checked += 1;
+            if checked.is_multiple_of(262_144) {
+                reporter.bar(
+                    "Verifying replacement conservation",
+                    checked,
+                    None,
+                    "objects",
+                );
+            }
+            while output_objects.peek().is_some_and(|next| *next < oid) {
+                output_objects.next();
+            }
+            if output_objects.peek() != Some(&oid) {
+                return Err(WalError::Invalid(format!(
+                    "replacement loses indexed object {oid}"
+                )));
+            }
+        }
+        reporter.bar(
+            "Verifying replacement conservation",
+            checked,
+            Some(checked),
+            "objects",
+        );
+        for reference in refs.refs {
+            let oid = ObjectId::from_hex(reference.oid.as_bytes())
+                .map_err(|e| WalError::Corrupt(e.to_string()))?;
+            if !indexes
+                .iter()
+                .any(|(p, i)| retained.contains(&p.checksum) && i.lookup(oid).is_some())
+            {
+                return Err(WalError::Invalid(format!(
+                    "replacement does not cover current tip {} ({oid})",
+                    reference.name
+                )));
+            }
+        }
+        Ok(())
+    })
+    .await
+    .map_err(|e| WalError::Corrupt(e.to_string()))?
+}
diff --git a/crates/walgit-wal/src/error.rs b/crates/walgit-wal/src/error.rs
index 5ca8bb7..aa4bb9b 100644
--- a/crates/walgit-wal/src/error.rs
+++ b/crates/walgit-wal/src/error.rs
@@ -32,13 +32,17 @@ pub enum WalError {
     Invalid(String),
     #[error("retry exhausted after {attempts} attempts")]
     Retry { attempts: u32 },
+    /// The CAS may have committed or may still land. Absence of evidence is
+    /// not a definite rejection and must never become report-status `ng`.
+    #[error("commit outcome unknown: {0}")]
+    CommitUnknown(String),
     #[error(transparent)]
     Io(#[from] std::io::Error),
     /// The live pack set does not fit this instance's cache (`cache.max_bytes`);
     /// refs-level operations still work, object access must go elsewhere
     /// (bundle-uri, a disk-backed backend).
     #[error(
-        "repository pack set is {bytes} bytes, larger than this instance's cache limit ({max} bytes); clone via bundle-uri"
+        "repository pack set is {bytes} bytes, larger than this instance's cache limit ({max} bytes); retry on a host with enough capacity or use a bounded clone"
     )]
     TooLarge { bytes: u64, max: u64 },
 }
diff --git a/crates/walgit-wal/src/handle.rs b/crates/walgit-wal/src/handle.rs
index 6f9667e..85b262b 100644
--- a/crates/walgit-wal/src/handle.rs
+++ b/crates/walgit-wal/src/handle.rs
@@ -46,7 +46,7 @@ pub struct RepoHandle {
 
     // Prevents pack removal during reads. Uses tokio::sync::RwLock because
     // guards are held across .await points (freshness check, apply_delta).
-    pub(crate) rw: TokioRwLock<()>,
+    pub(crate) rw: Arc<TokioRwLock<()>>,
     // Single in-flight sync.
     pub(crate) sync_mutex: TokioMutex<()>,
     /// Serializes pack reconciliation (downloads/links/removals). Held
@@ -149,7 +149,7 @@ impl RepoHandle {
             local,
             store,
             cfg,
-            rw: TokioRwLock::new(()),
+            rw: Arc::new(TokioRwLock::new(())),
             sync_mutex: TokioMutex::new(()),
             pack_mutex: TokioMutex::new(()),
             manifest: PLRwLock::new(Arc::new(manifest)),
@@ -368,6 +368,24 @@ impl RepoHandle {
         self.manifest.read().clone()
     }
 
+    /// Capture the exact manifest and its CAS token atomically.
+    pub fn manifest_pair(&self) -> (Arc<Manifest>, Option<Version>) {
+        let manifest = self.manifest.read();
+        (manifest.clone(), self.manifest_version.lock().clone())
+    }
+
+    /// Caller serializes ref application with `sync_mutex`. A late successful
+    /// publisher must not roll a cache back after another request synced ahead.
+    pub(crate) fn adopt_manifest(&self, manifest: Arc<Manifest>, version: Version) -> bool {
+        let mut current = self.manifest.write();
+        if current.revision > manifest.revision {
+            return false;
+        }
+        *self.manifest_version.lock() = Some(version);
+        *current = manifest;
+        true
+    }
+
     pub fn manifest_version(&self) -> Option<Version> {
         self.manifest_version.lock().clone()
     }
@@ -402,6 +420,13 @@ impl RepoHandle {
     /// Like [`sync`] but every pack is a real local copy (base rebuilds,
     /// bundle builds and anything else that streams whole packs). Refused with
     /// `TooLarge` when the set does not fit `cache.max_bytes`.
+    /// Pin installed object files across an owned blocking maintenance task.
+    /// Unlike a borrowed request guard, cancellation of its caller cannot release
+    /// this pin while a detached blocking worker still copies the input files.
+    pub async fn pin_local_objects(&self) -> tokio::sync::OwnedRwLockReadGuard<()> {
+        self.rw.clone().read_owned().await
+    }
+
     pub async fn sync_full(&self) -> Result<crate::sync::ReadGuard<'_>, WalError> {
         self.sync_level(SyncLevel::Full).await
     }
@@ -420,6 +445,14 @@ impl RepoHandle {
         Ok(guard)
     }
 
+    /// Revalidate immutable download membership without materializing pack data.
+    /// Bucket existence alone never authorizes a pack or index download.
+    pub async fn serves_pack_fresh(&self, checksum: &str) -> Result<bool, WalError> {
+        let _sync = self.sync_mutex.lock().await;
+        self.sync_locked_inner(&tracing::Span::current()).await?;
+        Ok(self.manifest().serves_pack(checksum))
+    }
+
     /// Whether a refs-level sync should pull the serving copy in the background:
     /// configured, not yet reconciled, this host serves the repository's objects
     /// (placement — a host that does not never pulls its packs, not even in the
@@ -746,7 +779,9 @@ impl RepoHandle {
             .map(|p| {
                 // History packs (commits + trees of a base) are always local:
                 // that is the point of them.
-                let how = if p.tier != 2 || p.kind == walgit_proto::v1::PackKind::History as i32 {
+                let redundant_history = p.kind == walgit_proto::v1::PackKind::History as i32
+                    && p.pack_groups.is_empty() && !p.derived_from.is_empty();
+                let how = if p.tier != 2 || redundant_history {
                     PackPlan::Local
                 } else if let Some(m) = mount.as_ref() {
                     let target = crate::sync::mount_pack_path(m, &p.checksum);
@@ -788,7 +823,7 @@ impl RepoHandle {
 
     /// Freshness check + refs apply, with `sync_mutex` and the write lock held
     /// by the caller. Packs are never touched here (see `sync_packs_phase`).
-    async fn sync_locked_inner(&self, span: &tracing::Span) -> Result<(), WalError> {
+    pub(crate) async fn sync_locked_inner(&self, span: &tracing::Span) -> Result<(), WalError> {
         let known = self.manifest_version.lock().clone();
         let outcome = crate::sync::freshness_check(&self.store, known.as_ref()).await?;
         match outcome {
@@ -814,7 +849,7 @@ impl RepoHandle {
                 if initialised && manifest.revision == cur.revision {
                     // Same content under a version we did not record (a publish that learned the version
                     // by HEAD): adopt the version so the next check is a 304, apply nothing.
-                    *self.manifest_version.lock() = Some(meta_version);
+                    self.adopt_manifest(manifest.clone(), meta_version);
                     self.update_freshness();
                     return Ok(());
                 }
@@ -822,8 +857,7 @@ impl RepoHandle {
                 let before = self.state.lock().applied_seq;
                 crate::sync::apply_delta(self, &manifest, &meta_version).await?;
                 span.record("entries_applied", manifest.head_seq.saturating_sub(before));
-                *self.manifest.write() = manifest;
-                *self.manifest_version.lock() = Some(meta_version);
+                self.adopt_manifest(manifest, meta_version);
                 self.update_freshness();
             }
         }
@@ -906,11 +940,12 @@ impl RepoHandle {
             return Err(WalError::NotFound);
         };
 
+        crate::validate_manifest(&manifest)?;
+
         // Reset state and re-materialize
         crate::sync::materialize_from_scratch(self, &manifest, &meta.version).await?;
 
-        *self.manifest.write() = Arc::new(manifest);
-        *self.manifest_version.lock() = Some(meta.version);
+        self.adopt_manifest(Arc::new(manifest), meta.version);
         self.last_freshness.lock().take();
 
         Ok(())
@@ -983,6 +1018,11 @@ impl RepoHandle {
         synced: bool,
         created_at: Option<prost_types::Timestamp>,
     ) -> Result<PublishResult, WalError> {
+        if pack.is_some() && txn.updates.is_empty() {
+            return Err(WalError::Invalid(
+                "a push pack requires a nonempty ref transaction".into(),
+            ));
+        }
         let sender = self.get_or_init_publisher()?;
         self.publish_waiters.fetch_add(1, Ordering::Relaxed);
         let (tx, rx) = tokio::sync::oneshot::channel();
@@ -1025,17 +1065,41 @@ impl RepoHandle {
         crate::publish::publish_compact_impl(self, new_pack, supersedes, tier).await
     }
 
+    /// Publish a producer-proved classified pack and its exact coverage input.
+    /// Graph closure and conservation remain obligations of the producer.
+    pub async fn publish_compact_covering(
+        &self,
+        new_pack: walgit_git::PackInfo,
+        supersedes: Vec<gix_hash::ObjectId>,
+        tier: u32,
+        classification: &crate::PackClassification,
+        snapshots: &[crate::CoverageSnapshot],
+    ) -> Result<u64, WalError> {
+        crate::publish::publish_compact_classified(
+            self,
+            new_pack,
+            supersedes,
+            tier,
+            Some(classification),
+            snapshots,
+        )
+        .await
+    }
+
     /// D24: the repository's settings as last applied (manifest-inline).
     pub fn settings(&self) -> Option<walgit_proto::v1::RepoSettings> {
         self.manifest().settings.clone()
     }
 
     /// D24: effective configuration = host config ⊕ this repository's
-    /// settings, cached per settings revision. Settings that no longer parse
+    /// settings, cached per settings revision. Saved pre-removal bundle settings
+    /// are omitted from this derived view only; the durable document is unchanged.
+    /// Settings that no longer parse
     /// against this build fall back to the host config with a warning
     /// (never a failure on a read path).
     pub fn effective_config(&self) -> Arc<walgit_config::Config> {
-        let settings = self.settings();
+        let manifest = self.manifest();
+        let settings = &manifest.settings;
         let rev = settings.as_ref().map_or(0, |s| s.revision);
         if rev == 0 {
             return self.cfg.clone();
@@ -1045,18 +1109,88 @@ impl RepoHandle {
         {
             return c.clone();
         }
-        let toml = settings.as_ref().map_or("", |s| s.toml.as_str());
-        let cfg = match self.cfg.with_settings(toml) {
-            Ok(c) => Arc::new(c),
-            Err(e) => {
-                tracing::warn!(repo = %self.id, revision = rev, error = %e, "repo settings do not apply to this build; using the host config");
-                self.cfg.clone()
-            }
-        };
+        let cfg = self.config_for_manifest(&manifest);
         *self.effective.lock() = Some((rev, cfg.clone()));
         cfg
     }
 
+    /// Validate the effective policy for exactly the currently held generation.
+    pub fn validated_effective_config(&self) -> Result<Arc<walgit_config::Config>, WalError> {
+        self.validated_config_for_manifest(&self.manifest())
+    }
+
+    pub(crate) fn config_for_manifest(&self, manifest: &Manifest) -> Arc<walgit_config::Config> {
+        self.validated_config_for_manifest(manifest).unwrap_or_else(|e| {
+            tracing::warn!(repo = %self.id, error = %e, "repo settings do not apply to this build; using the host config");
+            self.cfg.clone()
+        })
+    }
+
+    pub(crate) fn validated_config_for_manifest(
+        &self,
+        manifest: &Manifest,
+    ) -> Result<Arc<walgit_config::Config>, WalError> {
+        let toml = manifest.settings.as_ref().map_or("", |s| s.toml.as_str());
+        let rev = manifest.settings.as_ref().map_or(0, |s| s.revision);
+        // Bucket-data compatibility, deliberately absent from Config::with_settings:
+        // host files and new settings writes must reject the removed section.
+        let mut migrated = None;
+        if toml.len() <= walgit_config::SETTINGS_MAX_BYTES
+            && let Ok(mut doc) = toml.parse::<toml::Table>()
+        {
+            let mut changed = false;
+            if matches!(doc.get("bundles"), Some(toml::Value::Table(_))) {
+                doc.remove("bundles");
+                changed = true;
+                tracing::warn!(repo = %self.id, revision = rev,
+                    "migrating saved repo settings: ignoring obsolete [bundles]; durable settings and history are unchanged");
+            }
+            if let Some(toml::Value::Table(old)) = doc.get("compaction").cloned() {
+                if doc.contains_key("packs") {
+                    return Err(WalError::Invalid("saved settings contain both [compaction] and [packs]; explicit administrator rewrite required".into()));
+                }
+                let mut packs = toml::Table::new();
+                let mut disabled = false;
+                for (key, value) in old {
+                    let target = match key.as_str() {
+                        "enabled" => "enabled",
+                        "factor" => "geometric_factor",
+                        "trigger_packs" => "fold_when_fresh_packs_reach",
+                        "lease_ttl" => "lease_ttl",
+                        "trigger_bytes" | "retention_superseded" => {
+                            disabled = true;
+                            continue;
+                        }
+                        "engine" if value.as_str() == Some("git") => continue,
+                        _ => {
+                            return Err(WalError::Invalid(format!(
+                                "saved compaction setting {key} cannot be migrated; administrator rewrite required"
+                            )));
+                        }
+                    };
+                    packs.insert(target.to_string(), value);
+                }
+                if disabled {
+                    packs.insert("enabled".into(), toml::Value::Boolean(false));
+                    tracing::warn!(repo = %self.id, revision = rev,
+                        "saved compaction byte/retention policy has no safe pack-lifecycle mapping; packs disabled until administrator rewrites settings");
+                }
+                doc.remove("compaction");
+                doc.insert("packs".into(), toml::Value::Table(packs));
+                changed = true;
+                tracing::warn!(repo = %self.id, revision = rev,
+                    "migrating supported saved [compaction] settings to [packs]; durable settings and history are unchanged");
+            }
+            if changed {
+                migrated = Some(doc.to_string());
+            }
+        }
+        self.cfg
+            .with_settings(migrated.as_deref().unwrap_or(toml))
+            .map(Arc::new)
+            .map_err(|e| WalError::Invalid(format!("saved settings revision {rev}: {e:#}")))
+    }
+
     /// D24: validate and publish new settings (whole-document replace): a
     /// SETTINGS log entry + the manifest's inline copy, one CAS. Returns the
     /// new revision. `toml` empty = clear.
@@ -1103,6 +1237,73 @@ impl RepoHandle {
         crate::publish::add_pack_impl(self, pack, idx, tier, history_of).await
     }
 
+    /// Publish a verified maintenance output additively. Its descriptor is
+    /// explicit: local directory scans may include rejected or concurrent work.
+    /// The caller retains the isolated input until the final replacement seal.
+    pub async fn publish_prepared_pack(
+        &self,
+        path: &std::path::Path,
+        descriptor: &walgit_proto::v1::PackRef,
+        classification: crate::PackClassification,
+    ) -> Result<u64, WalError> {
+        let checksum = gix_hash::ObjectId::from_hex(descriptor.checksum.as_bytes())
+            .map_err(|e| WalError::Invalid(format!("output checksum: {e}")))?;
+        // install_pack moves its input; preserve resumable scratch receipts by
+        // installing copies owned by a short-lived staging directory.
+        let source = path.to_path_buf();
+        let desc = descriptor.clone();
+        let staging = tokio::task::spawn_blocking(move || -> Result<_, std::io::Error> {
+            let dir = tempfile::tempdir()?;
+            for (present, extension) in [
+                (true, "pack"),
+                (true, "idx"),
+                (desc.has_rev, "rev"),
+                (desc.has_bitmap, "bitmap"),
+                (desc.has_commit_graph, "commit-graph"),
+            ] {
+                if present {
+                    std::fs::copy(
+                        source.with_extension(extension),
+                        dir.path()
+                            .join(format!("pack-{}.{}", desc.checksum, extension)),
+                    )?;
+                }
+            }
+            Ok(dir)
+        })
+        .await
+        .map_err(|e| WalError::Invalid(format!("output staging: {e}")))??;
+        let path = staging
+            .path()
+            .join(format!("pack-{}.pack", descriptor.checksum));
+        let mut extras = Vec::new();
+        for (present, extension) in [
+            (descriptor.has_rev, "rev"),
+            (descriptor.has_bitmap, "bitmap"),
+            (descriptor.has_commit_graph, "commit-graph"),
+        ] {
+            if present {
+                extras.push(path.with_extension(extension));
+            }
+        }
+        self.local
+            .install_pack(&path, &path.with_extension("idx"), &extras)
+            .await?;
+        let info = walgit_git::PackInfo {
+            checksum,
+            pack_size: descriptor.pack_size,
+            idx_size: descriptor.idx_size,
+            object_count: descriptor.object_count,
+            has_rev: descriptor.has_rev,
+            has_bitmap: descriptor.has_bitmap,
+            has_commit_graph: descriptor.has_commit_graph,
+            history_of: (!descriptor.derived_from.is_empty())
+                .then(|| descriptor.derived_from.clone()),
+        };
+        self.publish_compact_covering(info, Vec::new(), descriptor.tier, &classification, &[])
+            .await
+    }
+
     /// Whether the last known manifest wants a checkpoint, and why.
     pub fn checkpoint_due(&self) -> Option<crate::checkpoint::CheckpointTrigger> {
         crate::checkpoint::checkpoint_due(&self.manifest(), &self.cfg.wal)
diff --git a/crates/walgit-wal/src/index_cache.rs b/crates/walgit-wal/src/index_cache.rs
new file mode 100644
index 0000000..a6f7d6a
--- /dev/null
+++ b/crates/walgit-wal/src/index_cache.rs
@@ -0,0 +1,461 @@
+//! Validated immutable indexes. A cross-process lock protects names while they
+//! are opened/replaced; returned mappings own their bytes across later unlinks.
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use walgit_proto::v1::PackRef;
+use walgit_store::Prefixed;
+
+use crate::{WalError, progress::Reporter};
+
+struct CacheLock(std::fs::File);
+impl Drop for CacheLock {
+    fn drop(&mut self) {
+        let _ = self.0.unlock();
+    }
+}
+
+async fn lock(dir: &Path, reporter: &Reporter) -> Result<Arc<CacheLock>, WalError> {
+    tokio::fs::create_dir_all(dir).await?;
+    let file = tokio::fs::OpenOptions::new()
+        .create(true)
+        .truncate(false)
+        .read(true)
+        .write(true)
+        .open(dir.join(".index-cache.lock"))
+        .await?
+        .into_std()
+        .await;
+    let start = tokio::time::Instant::now();
+    let mut narrated = false;
+    loop {
+        match file.try_lock() {
+            Ok(()) => return Ok(Arc::new(CacheLock(file))),
+            Err(std::fs::TryLockError::WouldBlock) => {
+                if !narrated {
+                    reporter.notice("Waiting for another index-cache operation");
+                    narrated = true;
+                }
+                if start.elapsed() >= std::time::Duration::from_secs(30) {
+                    return Err(WalError::Io(std::io::Error::new(
+                        std::io::ErrorKind::WouldBlock,
+                        "index cache busy; retry",
+                    )));
+                }
+                tokio::time::sleep(std::time::Duration::from_millis(25)).await;
+            }
+            Err(std::fs::TryLockError::Error(error)) => return Err(error.into()),
+        }
+    }
+}
+
+fn validate(
+    path: &Path,
+    pack: &PackRef,
+    hash: gix_hash::Kind,
+) -> Result<gix_pack::index::File, WalError> {
+    walgit_git::object_links::verified_index(path, pack, hash).map_err(WalError::from)
+}
+
+async fn one(
+    store: Prefixed,
+    repo: PathBuf,
+    pack: PackRef,
+    hash: gix_hash::Kind,
+    guard: Arc<CacheLock>,
+) -> Result<(PackRef, gix_pack::index::File), WalError> {
+    let dir = crate::remote::idx_dir(&repo);
+    let dest = dir.join(format!("{}.idx", pack.checksum));
+    let reuse = tokio::task::spawn_blocking({
+        let guard = guard.clone();
+        let pack = pack.clone();
+        let dest = dest.clone();
+        let dir = dir.clone();
+        move || -> Result<Option<gix_pack::index::File>, WalError> {
+            let _guard = guard;
+            if let Ok(index) = validate(&dest, &pack, hash) {
+                return Ok(Some(index));
+            }
+            let installed = repo
+                .join("objects/pack")
+                .join(format!("pack-{}.idx", pack.checksum));
+            if validate(&installed, &pack, hash).is_ok() {
+                let temp = tempfile::Builder::new()
+                    .prefix(".index-")
+                    .suffix(".tmp")
+                    .tempfile_in(&dir)?
+                    .into_temp_path();
+                std::fs::remove_file(&temp)?;
+                if std::fs::hard_link(&installed, &temp).is_err() {
+                    std::fs::copy(&installed, &temp)?;
+                }
+                let index = validate(&temp, &pack, hash)?;
+                std::fs::rename(&temp, &dest)?;
+                return Ok(Some(index));
+            }
+            Ok(None)
+        }
+    })
+    .await
+    .map_err(|e| WalError::Corrupt(e.to_string()))??;
+    if let Some(index) = reuse {
+        return Ok((pack, index));
+    }
+    let temp = tokio::task::spawn_blocking({
+        let dir = dir.clone();
+        let guard = guard.clone();
+        move || {
+            let _guard = guard;
+            tempfile::Builder::new()
+                .prefix(".index-")
+                .suffix(".tmp")
+                .tempfile_in(dir)
+                .map(tempfile::NamedTempFile::into_temp_path)
+        }
+    })
+    .await
+    .map_err(|e| WalError::Corrupt(e.to_string()))??;
+    crate::sync::download_object(
+        &store,
+        &walgit_proto::keys::idx_key(&pack.checksum),
+        &temp,
+        (pack.idx_size != 0).then_some(pack.idx_size),
+        None,
+    )
+    .await?;
+    tokio::task::spawn_blocking(move || {
+        let _guard = guard;
+        let index = validate(&temp, &pack, hash)?;
+        std::fs::rename(&temp, dest)?;
+        Ok((pack, index))
+    })
+    .await
+    .map_err(|e| WalError::Corrupt(e.to_string()))?
+}
+
+/// Cold downloads run four at a time; cancellation aborts siblings. Temp names
+/// are attempt-owned, never shared truncation targets. The lock's kernel lifetime
+/// permits a successor to reclaim crash residue without an age or PID guess.
+pub(crate) async fn load(
+    store: &Prefixed,
+    repo: &Path,
+    packs: &[PackRef],
+    retained: &[PackRef],
+    hash: gix_hash::Kind,
+    reporter: &Reporter,
+) -> Result<Vec<(PackRef, gix_pack::index::File)>, WalError> {
+    let dir = crate::remote::idx_dir(repo);
+    let guard = lock(&dir, reporter).await?;
+    let mut names = tokio::fs::read_dir(&dir).await?;
+    while let Some(entry) = names.next_entry().await? {
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if name.starts_with(".index-") && name.ends_with(".tmp") {
+            tokio::fs::remove_file(entry.path()).await?;
+        }
+    }
+    let mut pending = packs.iter();
+    let mut tasks = tokio::task::JoinSet::new();
+    let mut loaded = Vec::with_capacity(packs.len());
+    loop {
+        while tasks.len() < 4 {
+            let Some(pack) = pending.next() else {
+                break;
+            };
+            tasks.spawn(one(
+                store.clone(),
+                repo.to_owned(),
+                pack.clone(),
+                hash,
+                guard.clone(),
+            ));
+        }
+        let Some(result) = tasks.join_next().await else {
+            break;
+        };
+        loaded.push(result.map_err(|e| WalError::Corrupt(e.to_string()))??);
+        reporter.bar(
+            "Validating pack indexes",
+            loaded.len() as u64,
+            Some(packs.len() as u64),
+            "indexes",
+        );
+    }
+    // Every opener and cached-name borrower holds the same lock. Existing readers
+    // own mmap snapshots; no active operation retains an unopened cache name.
+    let live: std::collections::HashSet<_> = retained.iter().map(|p| p.checksum.as_str()).collect();
+    let mut names = tokio::fs::read_dir(&dir).await?;
+    while let Some(entry) = names.next_entry().await? {
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if let Some(checksum) = name.strip_suffix(".idx")
+            && !live.contains(checksum)
+        {
+            tokio::fs::remove_file(entry.path()).await?;
+        }
+    }
+    Ok(loaded)
+}
+
+/// Borrow a cached name only while locked, validate it, and create the caller's
+/// independent link before yielding. Used by mount-based pack installation.
+pub(crate) async fn reuse(
+    repo: &Path,
+    pack: &PackRef,
+    hash: gix_hash::Kind,
+    dest: PathBuf,
+    reporter: &Reporter,
+) -> Result<bool, WalError> {
+    let dir = crate::remote::idx_dir(repo);
+    let guard = lock(&dir, reporter).await?;
+    let pack = pack.clone();
+    tokio::task::spawn_blocking(move || {
+        let _guard = guard;
+        let source = dir.join(format!("{}.idx", pack.checksum));
+        if validate(&source, &pack, hash).is_err() {
+            return Ok(false);
+        }
+        if std::fs::hard_link(&source, &dest).is_err() {
+            std::fs::copy(&source, &dest)?;
+        }
+        Ok(true)
+    })
+    .await
+    .map_err(|e| WalError::Corrupt(e.to_string()))?
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+    use walgit_store::{ObjectStoreExt, PutMode, memory::MemoryStore};
+
+    fn git(dir: &Path, args: &[&str], input: &str) -> anyhow::Result<String> {
+        let mut child = Command::new("git")
+            .arg("-C")
+            .arg(dir)
+            .args(args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()?;
+        child
+            .stdin
+            .take()
+            .ok_or_else(|| anyhow::anyhow!("missing stdin"))?
+            .write_all(input.as_bytes())?;
+        let output = child.wait_with_output()?;
+        anyhow::ensure!(
+            output.status.success(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        Ok(String::from_utf8(output.stdout)?.trim().to_owned())
+    }
+
+    #[tokio::test]
+    async fn repairs_corrupt_and_wrong_identity_indexes_and_pins_old_readers() -> anyhow::Result<()>
+    {
+        for format in ["sha1", "sha256"] {
+            let root = tempfile::tempdir()?;
+            git(
+                root.path(),
+                &["init", "--bare", &format!("--object-format={format}")],
+                "",
+            )?;
+            let hash = if format == "sha1" {
+                gix_hash::Kind::Sha1
+            } else {
+                gix_hash::Kind::Sha256
+            };
+            let mut fixtures = Vec::new();
+            for content in ["first", "second"] {
+                let oid = git(root.path(), &["hash-object", "-w", "--stdin"], content)?;
+                let checksum = git(
+                    root.path(),
+                    &["pack-objects", "objects/pack/pack"],
+                    &format!("{oid}\n"),
+                )?;
+                let installed = root
+                    .path()
+                    .join(format!("objects/pack/pack-{checksum}.idx"));
+                let bytes = std::fs::read(&installed)?;
+                fixtures.push((
+                    PackRef {
+                        checksum,
+                        idx_size: bytes.len() as u64,
+                        object_count: 1,
+                        ..Default::default()
+                    },
+                    bytes,
+                    installed,
+                    oid,
+                ));
+            }
+            let store = MemoryStore::shared();
+            let prefixed = Prefixed::new(store.clone(), "p/");
+            for (pack, bytes, _, _) in &fixtures {
+                store
+                    .put_bytes(
+                        &format!("p/{}", walgit_proto::keys::idx_key(&pack.checksum)),
+                        bytes.clone(),
+                        PutMode::Create,
+                    )
+                    .await?;
+            }
+            let (pack, bytes, installed, oid) = &fixtures[0];
+            let dir = crate::remote::idx_dir(root.path());
+            std::fs::create_dir_all(&dir)?;
+            let cached = dir.join(format!("{}.idx", pack.checksum));
+            std::fs::hard_link(installed, &cached)?;
+            // Both names point at a damaged inode. Repair must replace it, not
+            // trust the installed alias or rewrite a mapping another reader owns.
+            std::fs::set_permissions(
+                installed,
+                std::os::unix::fs::PermissionsExt::from_mode(0o600),
+            )?;
+            std::fs::write(installed, b"truncated")?;
+            std::fs::write(dir.join(".index-abandoned.tmp"), b"crash residue")?;
+            let reporter = Reporter::none();
+            let loaded = load(
+                &prefixed,
+                root.path(),
+                std::slice::from_ref(pack),
+                std::slice::from_ref(pack),
+                hash,
+                &reporter,
+            )
+            .await?;
+            let object = gix_hash::ObjectId::from_hex(oid.as_bytes())?;
+            assert!(loaded[0].1.lookup(object).is_some());
+            assert_eq!(std::fs::read(&cached)?, *bytes);
+            assert_eq!(std::fs::read(installed)?, b"truncated");
+            assert!(!dir.join(".index-abandoned.tmp").exists());
+            // A structurally valid index for another pack is not evidence.
+            std::fs::remove_file(&cached)?;
+            std::fs::write(&cached, &fixtures[1].1)?;
+            let repaired = load(
+                &prefixed,
+                root.path(),
+                std::slice::from_ref(pack),
+                std::slice::from_ref(pack),
+                hash,
+                &reporter,
+            )
+            .await?;
+            assert!(repaired[0].1.lookup(object).is_some());
+            load(&prefixed, root.path(), &[], &[], hash, &reporter).await?;
+            assert!(!cached.exists());
+            assert!(loaded[0].1.lookup(object).is_some());
+            assert!(repaired[0].1.lookup(object).is_some());
+        }
+        Ok(())
+    }
+
+    // Invoked only in a disposable child process by the crash regression.
+    #[test]
+    fn child_index_cache_owner() -> anyhow::Result<()> {
+        let Some(dir) = std::env::var_os("WALGIT_TEST_INDEX_LOCK_ROOT") else {
+            return Ok(());
+        };
+        let dir = PathBuf::from(dir);
+        let file = std::fs::OpenOptions::new()
+            .create(true)
+            .truncate(false)
+            .read(true)
+            .write(true)
+            .open(dir.join(".index-cache.lock"))?;
+        file.try_lock()?;
+        std::fs::write(dir.join(".index-child.tmp"), b"in progress")?;
+        std::fs::write(dir.join("child-ready"), b"ready")?;
+        loop {
+            std::thread::park();
+        }
+    }
+
+    #[tokio::test]
+    async fn killed_process_releases_ownership_before_residue_reclaim() -> anyhow::Result<()> {
+        struct ChildOwner(std::process::Child);
+        impl Drop for ChildOwner {
+            fn drop(&mut self) {
+                let _ = self.0.kill();
+                let _ = self.0.wait();
+            }
+        }
+        let root = tempfile::tempdir()?;
+        let dir = crate::remote::idx_dir(root.path());
+        std::fs::create_dir_all(&dir)?;
+        let mut child = ChildOwner(
+            Command::new(std::env::current_exe()?)
+                .args([
+                    "--exact",
+                    "index_cache::tests::child_index_cache_owner",
+                    "--nocapture",
+                ])
+                .env("WALGIT_TEST_INDEX_LOCK_ROOT", &dir)
+                .stdout(Stdio::null())
+                .stderr(Stdio::null())
+                .spawn()?,
+        );
+        tokio::time::timeout(std::time::Duration::from_secs(5), async {
+            while !dir.join("child-ready").exists() {
+                tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+            }
+        })
+        .await?;
+        let contender = std::fs::OpenOptions::new()
+            .read(true)
+            .write(true)
+            .open(dir.join(".index-cache.lock"))?;
+        assert!(matches!(
+            contender.try_lock(),
+            Err(std::fs::TryLockError::WouldBlock)
+        ));
+        assert!(dir.join(".index-child.tmp").exists());
+        child.0.kill()?;
+        child.0.wait()?;
+        let store = Prefixed::new(MemoryStore::shared(), "p/");
+        load(
+            &store,
+            root.path(),
+            &[],
+            &[],
+            gix_hash::Kind::Sha1,
+            &Reporter::none(),
+        )
+        .await?;
+        assert!(!dir.join(".index-child.tmp").exists());
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn blocking_owner_keeps_lock_after_request_cancellation() -> anyhow::Result<()> {
+        let dir = tempfile::tempdir()?;
+        let guard = lock(dir.path(), &Reporter::none()).await?;
+        let worker_guard = guard.clone();
+        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
+        let (release_tx, release_rx) = std::sync::mpsc::channel();
+        let worker = tokio::task::spawn_blocking(move || {
+            let _guard = worker_guard;
+            let _ = started_tx.send(());
+            release_rx.recv()
+        });
+        started_rx.await?;
+        drop(guard);
+        worker.abort();
+        let contender = std::fs::OpenOptions::new()
+            .read(true)
+            .write(true)
+            .open(dir.path().join(".index-cache.lock"))?;
+        assert!(matches!(
+            contender.try_lock(),
+            Err(std::fs::TryLockError::WouldBlock)
+        ));
+        release_tx.send(())?;
+        worker.await??;
+        contender.try_lock()?;
+        contender.unlock()?;
+        Ok(())
+    }
+}
diff --git a/crates/walgit-wal/src/lib.rs b/crates/walgit-wal/src/lib.rs
index d8bee04..1ff0a98 100644
--- a/crates/walgit-wal/src/lib.rs
+++ b/crates/walgit-wal/src/lib.rs
@@ -2,26 +2,32 @@
 //! catch-up/materialize of local repos, ref snapshots. See AGENTS.md §2 and AGENTS.md §2.
 
 mod checkpoint;
+mod classification;
+mod closure;
 mod error;
 mod handle;
+mod index_cache;
 pub mod lockwait;
 mod log_reader;
 pub mod progress;
 mod publish;
 mod registry;
 pub mod remote;
+mod snapshots;
 mod state;
 mod store_proto;
 mod sync;
 pub mod tasks;
 
 pub use checkpoint::{CheckpointTrigger, checkpoint_due};
+pub use classification::PackClassification;
 pub use error::{CoordError, RefError, WalError};
 pub use handle::{ObjectAccess, RepoHandle};
 pub use progress::{Progress, Reporter};
 pub use publish::PublishResult;
 pub use registry::{EvictReport, Registry};
 pub use remote::{BlockCache, RemotePacks};
+pub use snapshots::{CoverageSnapshot, FetchView, PublicationView, validate_manifest};
 pub use sync::{PackPlan, ReadGuard, SyncLevel};
 pub use tasks::{Begin, TaskHandle, TaskRecord, Tasks};
 
diff --git a/crates/walgit-wal/src/log_reader.rs b/crates/walgit-wal/src/log_reader.rs
index 3b23594..d974a72 100644
--- a/crates/walgit-wal/src/log_reader.rs
+++ b/crates/walgit-wal/src/log_reader.rs
@@ -17,11 +17,20 @@ pub(crate) async fn read_log_impl(
     // lock-free conditional GET and use whichever manifest is newer. Taking
     // the repo's write lock here would deadlock callers that hold a read
     // guard (overview, tests), and freshness_ttl=0 makes that the common case.
-    let known = handle.manifest_version.lock().clone();
+    let (held, known) = handle.manifest_pair();
     let manifest = match crate::sync::freshness_check(&handle.store, known.as_ref()).await? {
-        crate::sync::SyncOutcome::Unchanged => handle.manifest.read().clone(),
+        crate::sync::SyncOutcome::Unchanged => held,
         crate::sync::SyncOutcome::Changed { manifest, .. } => manifest,
     };
+    read_log_manifest(handle, &manifest, from_seq, to_seq).await
+}
+
+pub(crate) async fn read_log_manifest(
+    handle: &RepoHandle,
+    manifest: &walgit_proto::v1::Manifest,
+    from_seq: u64,
+    to_seq: Option<u64>,
+) -> Result<Vec<LogEntry>, WalError> {
     let head_seq = manifest.head_seq;
     let to = to_seq.unwrap_or(head_seq).min(head_seq);
 
@@ -85,6 +94,9 @@ pub async fn refs_at_seq(
     seq: u64,
 ) -> Result<walgit_proto::v1::RefSnapshot, WalError> {
     let manifest = handle.manifest();
+    if seq > manifest.head_seq {
+        return Err(WalError::Corrupt(format!("future refs sequence {seq}")));
+    }
     let cp_ok = manifest.checkpoint.as_ref().is_some_and(|cp| cp.seq <= seq);
     if !cp_ok && manifest.min_seq > 1 && manifest.min_seq > seq {
         return Err(WalError::Corrupt(format!(
@@ -104,8 +116,6 @@ async fn replay_refs(
     handle: &super::handle::RepoHandle,
     cut: Cut,
 ) -> Result<(walgit_proto::v1::RefSnapshot, u64), WalError> {
-    use prost::Message;
-    use walgit_store::ObjectStoreExt;
     let manifest = handle.manifest();
     // Start point: checkpoint ≤ cut (checkpoint created_at on the ref; when
     // the ref has no timestamp, fall back to replaying from seq 0).
@@ -126,15 +136,10 @@ async fn replay_refs(
             }
         };
         if usable {
-            if let Some((_, bytes)) = handle.store().get_bytes(&cp.key).await? {
-                let cpo = walgit_proto::v1::Checkpoint::decode(bytes.as_ref())
-                    .map_err(|e| WalError::Corrupt(format!("checkpoint decode: {e}")))?;
-                if let Some((_, rb)) = handle.store().get_bytes(&cpo.refs_key).await? {
-                    snap = walgit_proto::v1::RefSnapshot::decode(rb.as_ref())
-                        .map_err(|e| WalError::Corrupt(format!("refs decode: {e}")))?;
-                    from_seq = cp.seq;
-                }
-            }
+            snap =
+                crate::snapshots::checkpoint_snapshot(handle.store(), cp, &manifest.object_format)
+                    .await?;
+            from_seq = cp.seq;
         } else if manifest.min_seq > 1 {
             // History before the checkpoint is folded and the checkpoint is
             // newer than the cut: the best we can do is the checkpoint state
@@ -146,7 +151,7 @@ async fn replay_refs(
         Cut::Seq(seq) => Some(seq),
         Cut::Time(_) => None,
     };
-    let entries = handle.read_log(from_seq + 1, to_seq).await?;
+    let entries = read_log_manifest(handle, &manifest, from_seq + 1, to_seq).await?;
     let mut map: std::collections::BTreeMap<String, walgit_proto::v1::Ref> =
         snap.refs.into_iter().map(|r| (r.name.clone(), r)).collect();
     let mut head_target = snap.head_target;
diff --git a/crates/walgit-wal/src/publish.rs b/crates/walgit-wal/src/publish.rs
index 6d92f99..07a23bd 100644
--- a/crates/walgit-wal/src/publish.rs
+++ b/crates/walgit-wal/src/publish.rs
@@ -51,6 +51,7 @@ use walgit_store::{ObjectStore, Prefixed, PutBody, PutMode, PutOptions, StoreErr
 
 /// Per-ref result within a publish.
 pub struct PublishResult {
+    /// Committed entry, or zero for a no-op/rejection (inspect `per_ref`).
     pub seq: u64,
     pub per_ref: Vec<(String, Result<(), RefError>)>,
 }
@@ -83,6 +84,8 @@ pub(crate) fn pack_ref_from_ingested(p: &IngestedPack, seq: u64) -> PackRef {
         tier: 0,
         kind: PackKind::Objects as i32,
         derived_from: String::new(),
+        published_at: Some(time::now()),
+        ..Default::default()
     }
 }
 
@@ -103,6 +106,8 @@ pub(crate) fn pack_ref_from_info(p: &PackInfo, seq: u64, tier: u32) -> PackRef {
             PackKind::Objects as i32
         },
         derived_from: p.history_of.clone().unwrap_or_default(),
+        published_at: Some(time::now()),
+        ..Default::default()
     }
 }
 
@@ -191,6 +196,8 @@ pub(crate) struct LogSlot {
     pub(crate) key: String,
     pub(crate) version: walgit_store::Version,
     pub(crate) first_seq: u64,
+    /// Exact attempt-unique immutable bytes, retained until the CAS resolves.
+    pub(crate) bytes: bytes::Bytes,
     /// Orphan segments (key, version as observed) whose seqs were burned to
     /// get here; CAS-deleted after our commit.
     pub(crate) burned: Vec<(String, walgit_store::Version)>,
@@ -217,9 +224,10 @@ pub(crate) async fn read_manifest_fresh(store: &Prefixed) -> Result<Option<Manif
     use walgit_store::ObjectStoreExt;
     match store.get_bytes(keys::MANIFEST).await? {
         Some((_, b)) => {
-            Ok(Some(Manifest::decode(b.as_ref()).map_err(|e| {
-                WalError::Corrupt(format!("manifest decode: {e}"))
-            })?))
+            let manifest = Manifest::decode(b.as_ref())
+                .map_err(|e| WalError::Corrupt(format!("manifest decode: {e}")))?;
+            crate::validate_manifest(&manifest)?;
+            Ok(Some(manifest))
         }
         None => Ok(None),
     }
@@ -236,9 +244,23 @@ pub(crate) async fn claim_log_slot(
     let mut burned: Vec<(String, walgit_store::Version)> = Vec::new();
     loop {
         let key = keys::log_segment_key(seq);
-        let bytes = encode(seq);
+        let encoded = encode(seq);
+        let (mut entries, consumed) = frame::decode_entries(&encoded)
+            .map_err(|error| WalError::Corrupt(format!("candidate log: {error}")))?;
+        if consumed != encoded.len() || entries.is_empty() {
+            return Err(WalError::Corrupt("incomplete candidate log".into()));
+        }
+        // Content-based version tokens can repeat after delete/recreate. A
+        // fresh nonce prevents a delayed delete from matching a later attempt.
+        if let Some(first) = entries.first_mut() {
+            first.meta.insert(
+                "walgit.publication_nonce".into(),
+                uuid::Uuid::new_v4().to_string(),
+            );
+        }
+        let bytes = frame::encode_entries(&entries);
         match store
-            .put(&key, PutBody::Bytes(bytes), PutMode::Create.into())
+            .put(&key, PutBody::Bytes(bytes.clone()), PutMode::Create.into())
             .await
         {
             Ok(meta) => {
@@ -246,6 +268,7 @@ pub(crate) async fn claim_log_slot(
                     key,
                     version: meta.version,
                     first_seq: seq,
+                    bytes,
                     burned,
                 }));
             }
@@ -309,17 +332,29 @@ pub(crate) async fn drop_own_slot(store: &Prefixed, slot: &LogSlot) {
 
 /// After a manifest CAS failed with a non-412 error: did the write land?
 /// `Ok(Some(manifest))` when the fresh manifest lists our segment (committed),
-/// `Ok(None)` when it does not (not committed; leave the orphan alone).
+/// `Ok(None)` when evidence is absent (unknown, not rejection; leave it alone).
 pub(crate) async fn cas_landed(
     store: &Prefixed,
     slot: &LogSlot,
-) -> Result<Option<Manifest>, WalError> {
-    let fresh = read_manifest_fresh(store).await?;
-    Ok(fresh.filter(|m| {
-        m.log_segments
-            .iter()
-            .any(|s| s.key == slot.key && s.first_seq == slot.first_seq)
-    }))
+) -> Result<Option<(Manifest, walgit_store::Version)>, WalError> {
+    use walgit_store::ObjectStoreExt;
+    let Some((meta, manifest)) =
+        crate::store_proto::get_message::<Manifest>(store, keys::MANIFEST).await?
+    else {
+        return Ok(None);
+    };
+    crate::validate_manifest(&manifest)?;
+    let listed = manifest.log_segments.iter().any(|s| {
+        s.key == slot.key && s.first_seq == slot.first_seq && s.size == slot.bytes.len() as u64
+    });
+    if !listed {
+        return Ok(None);
+    }
+    let exact = store
+        .get_bytes(&slot.key)
+        .await?
+        .is_some_and(|(_, bytes)| bytes == slot.bytes);
+    Ok(exact.then_some((manifest, meta.version)))
 }
 
 /// Verify a ref transaction against a working ref map. Returns per-ref results.
@@ -494,16 +529,18 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
         {
             return finish_all_errors(batch, e);
         }
-        let manifest = handle.manifest.read().clone();
-        let head_seq = manifest.head_seq;
-        let known_version = handle.manifest_version.lock().clone();
-
-        // O(log refs) lookups over the cached snapshot + an overlay of what this
-        // batch applied; never an O(refs) map per push.
-        let mut working_refs = match handle.local.ref_view() {
-            Ok(v) => v,
-            Err(e) => return finish_all_errors(batch, WalError::from(e)),
+        // Pair the O(1) cached ref view with the CAS basis under the same
+        // lock that applies refs. Release it before any store or bulk work.
+        let (manifest, known_version, mut working_refs) = {
+            let _sync = handle.sync_mutex.lock().await;
+            let (manifest, version) = handle.manifest_pair();
+            let refs = match handle.local.ref_view() {
+                Ok(v) => v,
+                Err(e) => return finish_all_errors(batch, WalError::from(e)),
+            };
+            (manifest, version, refs)
         };
+        let head_seq = manifest.head_seq;
 
         // 2. Verify each txn against working ref map (+ explicit created_at
         //    must be monotonic: >= the head entry's time, >= earlier explicit
@@ -512,6 +549,19 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
         let mut floor: Option<std::time::SystemTime> = *handle.last_entry_time.lock();
         for req in &batch {
             let mut per_ref = verify_txn(&req.txn, &working_refs);
+            let changes = req.pack.is_some()
+                || req.txn.updates.iter().any(|update| {
+                    if !update.new_symbolic_target.is_empty() {
+                        return update.name != "HEAD"
+                            || update.new_symbolic_target != working_refs.head_target();
+                    }
+                    let current = working_refs.get(&update.name).unwrap_or_default();
+                    if is_null_oid(&update.new_oid) {
+                        !current.is_empty()
+                    } else {
+                        current != update.new_oid
+                    }
+                });
             if let Some(ts) = &req.created_at {
                 let t = time::to_system(ts);
                 if let Some(f) = floor
@@ -526,17 +576,27 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
                         *r = Err(RefError::Rejected(msg.clone()));
                     }
                 }
-                if per_ref.iter().all(|(_, r)| r.is_ok()) {
+                if changes && per_ref.iter().all(|(_, r)| r.is_ok()) {
                     floor = Some(t);
                 }
             }
             let all_ok = per_ref.iter().all(|(_, r)| r.is_ok());
             if all_ok {
                 apply_txn_to_map(&req.txn, &mut working_refs);
+            } else {
+                for (_, status) in &mut per_ref {
+                    if status.is_ok() {
+                        *status = Err(RefError::Rejected(
+                            "another ref in the submission was rejected".into(),
+                        ));
+                    }
+                }
             }
             verified.push(Verified {
                 per_ref,
-                valid: all_ok,
+                // A no-op still validates its preconditions and reports success,
+                // but must not manufacture a log entry or claim a sibling's seq.
+                valid: all_ok && changes,
             });
         }
 
@@ -549,7 +609,7 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
             .collect();
 
         if valid_indices.is_empty() {
-            // All rejected — send responses and return
+            // Only rejected/no-op submissions: settle without a bucket write.
             let responses: Vec<PublishResult> = verified
                 .iter()
                 .map(|v| PublishResult {
@@ -566,6 +626,7 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
         // 4. Build log entries for valid requests. Seqs are assigned by the
         // slot claim (an orphan at head+1 may push us forward), so building
         // is a function of `first_seq`.
+        let published_at = time::now();
         let build = |first_seq: u64| -> (Vec<LogEntry>, Vec<PackRef>) {
             let mut entries = Vec::with_capacity(valid_indices.len());
             let mut new_packs = Vec::new();
@@ -576,7 +637,11 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
                 .enumerate()
             {
                 let seq = first_seq + offset as u64;
-                let pack_ref = req.pack.as_ref().map(|p| pack_ref_from_ingested(p, seq));
+                let pack_ref = req.pack.as_ref().map(|p| {
+                    let mut descriptor = pack_ref_from_ingested(p, seq);
+                    descriptor.published_at = Some(published_at);
+                    descriptor
+                });
                 if let Some(pr) = &pack_ref {
                     new_packs.push(pr.clone());
                 }
@@ -607,12 +672,10 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
             Ok::<(), WalError>(())
         }
         .instrument(span.clone());
-        let mut frame_len = 0usize;
+
         let claim = claim_log_slot(&handle.store, head_seq, |first_seq| {
             let (entries, _) = build(first_seq);
-            let b = frame::encode_entries(entries.iter());
-            frame_len = b.len();
-            b
+            frame::encode_entries(entries.iter())
         })
         .instrument(span.clone());
         let (pack_result, claim_result) = tokio::join!(pack_uploads, claim);
@@ -652,12 +715,11 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
         updated.head_seq = last_seq;
         updated.packs.extend(new_packs.iter().cloned());
         updated.packs.sort_by_key(|p| p.seq);
-
         let seg_ref = LogSegmentRef {
             key: slot.key.clone(),
             first_seq,
             last_seq,
-            size: frame_len as u64,
+            size: slot.bytes.len() as u64,
             sealed: true,
         };
         updated.log_segments.push(seg_ref);
@@ -684,19 +746,19 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
             .await;
         // A non-412 error is ambiguous: the bucket may have applied the CAS and
         // lost the response. Look before deciding.
-        let committed: Option<(Manifest, Option<walgit_store::Version>)> = match cas {
-            Ok(meta) => Some((updated, Some(meta.version))),
+        let committed: Option<(Manifest, walgit_store::Version)> = match cas {
+            Ok(meta) => Some((updated, meta.version)),
             Err(StoreError::PreconditionFailed { .. }) => None,
             Err(e) => match cas_landed(&handle.store, &slot)
                 .instrument(span.clone())
                 .await
             {
-                Ok(Some(fresh)) => {
+                Ok(Some((fresh, version))) => {
                     tracing::warn!(repo = %handle.id, seq = last_seq, "manifest CAS errored but landed: {e}");
-                    Some((fresh, None))
+                    Some((fresh, version))
                 }
                 Ok(None) => {
-                    // Not committed. Leave the segment: a later writer burns past
+                    // Outcome unknown. Leave the segment: a later writer burns past
                     // it and sweeps it; deleting here could race a lost-response
                     // commit that `cas_landed` itself failed to observe.
                     let msg = e.to_string();
@@ -710,22 +772,6 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
         };
 
         if let Some((committed, version)) = committed {
-            // Success! Update handle state. A landed-but-errored CAS leaves
-            // us without the new version: drop our cached one so the next
-            // sync refetches unconditionally.
-            let version = match version {
-                Some(v) => v,
-                None => match handle.store.head(keys::MANIFEST).await? {
-                    Some(m) => m.version,
-                    None => {
-                        return finish_with_error(
-                            batch,
-                            &valid_indices,
-                            WalError::Corrupt("manifest vanished after commit".into()),
-                        );
-                    }
-                },
-            };
             // The local commit — ref txns applied, then the new manifest version advertised — happens
             // under `sync_mutex`, the lock the refs phase of every sync holds: a sync that already read
             // the committed manifest would otherwise replay the same entry concurrently (two
@@ -748,7 +794,20 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
                     handle.sync_mutex.lock(),
                 )
                 .await;
-                for (req, _) in batch.iter().zip(&verified).filter(|(_, v)| v.valid) {
+                let applied_seq = handle.state.lock().applied_seq;
+                let already_applied = applied_seq >= last_seq;
+                if applied_seq < committed.head_seq
+                    && committed.head_seq > last_seq
+                    && let Err(e) = crate::sync::apply_delta(handle, &committed, &version).await
+                {
+                    tracing::warn!(error = %e, "landed push catch-up failed; next sync repairs it");
+                    local_ok = false;
+                }
+                for (req, _) in batch
+                    .iter()
+                    .zip(&verified)
+                    .filter(|(_, v)| v.valid && !already_applied && committed.head_seq == last_seq)
+                {
                     if let Err(e) = handle.local.apply_ref_txn(&req.txn, false) {
                         tracing::warn!(repo = %handle.id, seq = last_seq, error = %e, "published (CAS ok), but applying the ref txn to the local copy failed; the next sync replays it");
                         metrics::counter!("walgit_publish_local_apply_failed_total").increment(1);
@@ -768,14 +827,14 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
                 {
                     tokio::time::sleep(std::time::Duration::from_millis(ms)).await;
                 }
-                if local_ok {
-                    *handle.manifest.write() = Arc::new(committed.clone());
-                    *handle.manifest_version.lock() = Some(version.clone());
+                if local_ok && handle.adopt_manifest(Arc::new(committed.clone()), version.clone()) {
                     {
                         let mut state = handle.state.lock();
                         state.manifest_version = Some(version.as_str().to_string());
-                        state.applied_seq = last_seq;
-                        let ready = state.packs_ready();
+                        state.applied_seq = committed.head_seq;
+                        let ready = state.packs_ready()
+                            && state.revision == manifest.revision
+                            && committed.revision == manifest.revision + 1;
                         state.revision = committed.revision;
                         if ready {
                             state.packs_revision = committed.revision;
@@ -786,7 +845,7 @@ async fn process_batch(handle: &RepoHandle, batch: Vec<PublishRequest>) -> Resul
                     {
                         tracing::warn!(repo = %handle.id, error = %e, "published (CAS ok), but saving local state failed; the next sync repairs it");
                     }
-                } else {
+                } else if !local_ok {
                     // Forget the known version so the next sync performs an unconditional GET and
                     // replays from the last applied seq.
                     handle.manifest_version.lock().take();
@@ -893,7 +952,9 @@ fn finish_with_error_msg(
 ) -> Result<(), WalError> {
     let _ = valid_indices;
     for req in batch {
-        let _ = req.response.send(Err(WalError::Corrupt(msg.to_owned())));
+        let _ = req
+            .response
+            .send(Err(WalError::CommitUnknown(msg.to_owned())));
     }
     Err(err)
 }
@@ -941,6 +1002,17 @@ pub(crate) async fn publish_compact_impl(
     new_pack: PackInfo,
     supersedes: Vec<gix_hash::ObjectId>,
     tier: u32,
+) -> Result<u64, WalError> {
+    publish_compact_classified(handle, new_pack, supersedes, tier, None, &[]).await
+}
+
+pub(crate) async fn publish_compact_classified(
+    handle: &RepoHandle,
+    new_pack: PackInfo,
+    supersedes: Vec<gix_hash::ObjectId>,
+    tier: u32,
+    classification: Option<&crate::PackClassification>,
+    candidates: &[crate::CoverageSnapshot],
 ) -> Result<u64, WalError> {
     let writer = crate::handle::instance_id();
     let max_retries = handle.cfg.wal.cas_max_retries;
@@ -995,9 +1067,23 @@ pub(crate) async fn publish_compact_impl(
             handle.sync_impl().await?;
         }
 
-        let manifest = handle.manifest.read().clone();
-        let known_version = handle.manifest_version.lock().clone();
+        let (manifest, known_version) = handle.manifest_pair();
 
+        let mut pack_ref = pack_ref.clone();
+        if let Some(classification) = classification {
+            if classification.checksum != pack_ref.checksum {
+                return Err(WalError::Invalid(
+                    "classification names another output".into(),
+                ));
+            }
+            classification.apply(&mut pack_ref);
+        } else if let Some(previous) = manifest
+            .packs
+            .iter()
+            .find(|p| p.checksum == pack_ref.checksum)
+        {
+            crate::PackClassification::from_pack(previous).apply(&mut pack_ref);
+        }
         let entry_time = time::now();
         let make_entry = |seq: u64| LogEntry {
             seq,
@@ -1014,11 +1100,9 @@ pub(crate) async fn publish_compact_impl(
             meta: HashMap::new(),
             settings: None,
         };
-        let mut frame_len = 0usize;
+
         let slot = match claim_log_slot(&handle.store, manifest.head_seq, |seq| {
-            let b = frame::encode_entries(std::iter::once(&make_entry(seq)));
-            frame_len = b.len();
-            b
+            frame::encode_entries(std::iter::once(&make_entry(seq)))
         })
         .await?
         {
@@ -1036,6 +1120,12 @@ pub(crate) async fn publish_compact_impl(
         // Build updated manifest
         let mut updated: Manifest = (*manifest).clone();
         updated.head_seq = seq;
+        let retired: Vec<_> = supersedes_hex
+            .iter()
+            .filter(|id| **id != pack_ref.checksum)
+            .cloned()
+            .collect();
+        updated.retire_packs(&retired, seq);
         let sup_set: std::collections::HashSet<&str> = supersedes_hex
             .iter()
             .map(std::string::String::as_str)
@@ -1049,11 +1139,23 @@ pub(crate) async fn publish_compact_impl(
         });
         updated.packs.sort_by_key(|p| p.seq);
 
+        let changed = vec![pack_ref.checksum.clone()];
+        let cfg = handle.validated_config_for_manifest(&manifest)?;
+        crate::classification::prune_invalid_coverages(&mut updated, &cfg, &changed);
+        if let Err(e) = crate::classification::validate_certificates(
+            handle, &manifest, &updated, &changed, candidates,
+        )
+        .await
+        {
+            drop_own_slot(&handle.store, &slot).await;
+            return Err(e);
+        }
+
         let seg_ref = LogSegmentRef {
             key: slot.key.clone(),
             first_seq: seq,
             last_seq: seq,
-            size: frame_len as u64,
+            size: slot.bytes.len() as u64,
             sealed: true,
         };
         updated.log_segments.push(seg_ref);
@@ -1080,29 +1182,32 @@ pub(crate) async fn publish_compact_impl(
             Ok(meta) => Some((updated, meta.version)),
             Err(StoreError::PreconditionFailed { .. }) => None,
             Err(e) => match cas_landed(&handle.store, &slot).await {
-                Ok(Some(fresh)) => {
+                Ok(Some((fresh, version))) => {
                     tracing::warn!(repo = %handle.id, seq, "compact manifest CAS errored but landed: {e}");
-                    let v = handle
-                        .store
-                        .head(keys::MANIFEST)
-                        .await?
-                        .map(|m| m.version)
-                        .ok_or_else(|| {
-                            WalError::Corrupt("manifest vanished after commit".into())
-                        })?;
-                    Some((fresh, v))
+                    Some((fresh, version))
                 }
                 Ok(None) | Err(_) => return Err(WalError::Store(e)),
             },
         };
         if let Some((committed, version)) = committed {
-            *handle.manifest.write() = Arc::new(committed.clone());
-            *handle.manifest_version.lock() = Some(version.clone());
+            let _sync = handle.sync_mutex.lock().await;
+            let applied_seq = handle.state.lock().applied_seq;
+            if committed.head_seq > seq
+                && applied_seq < committed.head_seq
+                && let Err(e) = crate::sync::apply_delta(handle, &committed, &version).await
+            {
+                tracing::warn!(error = %e, "landed compact catch-up failed; next sync repairs it");
+                handle.manifest_version.lock().take();
+                return Ok(seq);
+            }
+            if !handle.adopt_manifest(Arc::new(committed.clone()), version.clone()) {
+                return Ok(seq);
+            }
             note_entry_time(handle, seq, &entry_time);
             {
                 let mut state = handle.state.lock();
                 state.manifest_version = Some(version.as_str().to_string());
-                state.applied_seq = seq;
+                state.applied_seq = committed.head_seq;
                 // The publisher's own superseded packs are removed by the next pack sync like
                 // everyone else's (a scratch-copy base rebuild leaves them in the serving copy;
                 // a geometric fold already deleted them — the removal is then a no-op).
@@ -1111,7 +1216,9 @@ pub(crate) async fn publish_compact_impl(
                         state.pending_pack_removals.push(s.clone());
                     }
                 }
-                let ready = state.packs_ready();
+                let ready = state.packs_ready()
+                    && state.revision == manifest.revision
+                    && committed.revision == manifest.revision + 1;
                 state.revision = committed.revision;
                 if ready {
                     state.packs_revision = committed.revision;
@@ -1182,8 +1289,7 @@ pub(crate) async fn annotate_pack_impl(
     }
     let mut attempts = 0u32;
     loop {
-        let current = handle.manifest.read().clone();
-        let known_version = handle.manifest_version.lock().clone();
+        let (current, known_version) = handle.manifest_pair();
         let mut updated: Manifest = (*current).clone();
         let Some(p) = updated.packs.iter_mut().find(|p| p.checksum == checksum) else {
             return Err(WalError::Corrupt(format!(
@@ -1217,8 +1323,10 @@ pub(crate) async fn annotate_pack_impl(
             .await
         {
             Ok(meta) => {
-                *handle.manifest.write() = Arc::new(updated.clone());
-                *handle.manifest_version.lock() = Some(meta.version.clone());
+                let _sync = handle.sync_mutex.lock().await;
+                if !handle.adopt_manifest(Arc::new(updated.clone()), meta.version.clone()) {
+                    return Ok(pack_ref);
+                }
                 {
                     let mut state = handle.state.lock();
                     state.manifest_version = Some(meta.version.as_str().to_string());
@@ -1299,8 +1407,7 @@ pub(crate) async fn publish_settings_impl(
     let mut attempts = 0u32;
     loop {
         handle.sync_impl_level(crate::sync::SyncLevel::Refs).await?;
-        let manifest = handle.manifest.read().clone();
-        let known_version = handle.manifest_version.lock().clone();
+        let (manifest, known_version) = handle.manifest_pair();
         let revision = manifest.settings.as_ref().map_or(0, |s| s.revision) + 1;
         let settings = walgit_proto::v1::RepoSettings {
             toml: toml_text.to_string(),
@@ -1325,11 +1432,9 @@ pub(crate) async fn publish_settings_impl(
             ]),
             settings: Some(settings.clone()),
         };
-        let mut frame_len = 0usize;
+
         let slot = match claim_log_slot(&handle.store, manifest.head_seq, |seq| {
-            let b = frame::encode_entries(std::iter::once(&make_entry(seq)));
-            frame_len = b.len();
-            b
+            frame::encode_entries(std::iter::once(&make_entry(seq)))
         })
         .await?
         {
@@ -1350,7 +1455,7 @@ pub(crate) async fn publish_settings_impl(
             key: slot.key.clone(),
             first_seq: seq,
             last_seq: seq,
-            size: frame_len as u64,
+            size: slot.bytes.len() as u64,
             sealed: true,
         });
         updated.log_segments.sort_by_key(|s| s.first_seq);
@@ -1372,14 +1477,22 @@ pub(crate) async fn publish_settings_impl(
             .await
         {
             Ok(meta) => {
-                *handle.manifest.write() = Arc::new(updated.clone());
-                *handle.manifest_version.lock() = Some(meta.version.clone());
+                let _sync = handle.sync_mutex.lock().await;
+                if !handle.adopt_manifest(Arc::new(updated.clone()), meta.version.clone()) {
+                    return Ok(revision);
+                }
                 note_entry_time(handle, seq, &entry_time);
                 {
                     let mut state = handle.state.lock();
                     state.manifest_version = Some(meta.version.as_str().to_string());
+                    let ready = state.packs_ready()
+                        && state.revision == manifest.revision
+                        && manifest.packs == updated.packs;
                     state.applied_seq = seq;
                     state.revision = updated.revision;
+                    if ready {
+                        state.packs_revision = updated.revision;
+                    }
                 }
                 crate::state::save_state(handle.local.path(), &handle.state.lock().clone())?;
                 *handle.effective.lock() = None;
@@ -1399,3 +1512,57 @@ pub(crate) async fn publish_settings_impl(
         }
     }
 }
+
+#[cfg(test)]
+mod claim_tests {
+    use super::*;
+    use walgit_store::ObjectStoreExt;
+
+    #[tokio::test]
+    async fn recreated_claims_have_distinct_bytes_and_resolution_checks_identity()
+    -> anyhow::Result<()> {
+        let truth = walgit_store::memory::MemoryStore::shared();
+        let store = Prefixed::new(truth, "repos/o/claims/");
+        let encode = |seq| {
+            frame::encode_entries([&LogEntry {
+                seq,
+                kind: EntryKind::Push as i32,
+                ..Default::default()
+            }])
+        };
+        let ClaimOutcome::Claimed(first) = claim_log_slot(&store, 0, encode).await? else {
+            anyhow::bail!("uncontended claim expected");
+        };
+        drop_own_slot(&store, &first).await;
+        let ClaimOutcome::Claimed(second) = claim_log_slot(&store, 0, encode).await? else {
+            anyhow::bail!("uncontended recreated claim expected");
+        };
+        assert_ne!(
+            first.bytes, second.bytes,
+            "content-based tokens must not alias attempts"
+        );
+        let manifest = Manifest {
+            format_version: walgit_proto::WAL_FORMAT_VERSION,
+            object_format: "sha1".into(),
+            head_seq: 1,
+            min_seq: 1,
+            log_segments: vec![LogSegmentRef {
+                key: second.key.clone(),
+                first_seq: 1,
+                last_seq: 1,
+                size: second.bytes.len() as u64,
+                sealed: true,
+            }],
+            ..Default::default()
+        };
+        store
+            .put_bytes(keys::MANIFEST, manifest.encode_to_vec(), PutMode::Create)
+            .await?;
+        assert!(
+            cas_landed(&store, &first).await?.is_none(),
+            "same key and sequence are insufficient"
+        );
+        assert!(cas_landed(&store, &second).await?.is_some());
+        Ok(())
+    }
+}
diff --git a/crates/walgit-wal/src/registry.rs b/crates/walgit-wal/src/registry.rs
index 5215d4c..9fc0147 100644
--- a/crates/walgit-wal/src/registry.rs
+++ b/crates/walgit-wal/src/registry.rs
@@ -101,6 +101,8 @@ impl Registry {
             return Err(WalError::NotFound);
         };
 
+        crate::validate_manifest(&manifest)?;
+
         // Open or init local repo (LocalRepo joins owner/name.git onto the root).
         let local = if let Some(l) = LocalRepo::open(&self.cache_root, id)? {
             l
@@ -110,9 +112,13 @@ impl Registry {
         };
 
         // Load state
-        let state = load_state(local.path());
+        let mut state = load_state(local.path());
+        // A persisted readiness counter is not evidence that inherited files
+        // are intact. Reconcile nonempty inventories once after process open.
+        state.packs_revision = 0;
 
-        let state_is_behind = state.applied_seq < manifest.head_seq;
+        let state_is_behind =
+            state.applied_seq < manifest.head_seq || state.revision != manifest.revision;
         let manifest_version = meta.version.clone();
 
         let handle = RepoHandle::new(
@@ -138,6 +144,10 @@ impl Registry {
             crate::sync::apply_delta(&handle, &manifest, &manifest_version).await?;
         }
 
+        if manifest.packs.is_empty() {
+            let mut state = handle.state.lock();
+            state.packs_revision = state.revision;
+        }
         self.repos.insert(id.clone(), handle.clone());
         Ok(handle)
     }
@@ -215,6 +225,7 @@ impl Registry {
             writer: crate::handle::instance_id(),
             revision: 1,
             settings: None,
+            retired_packs: Vec::new(),
         };
 
         let buf = manifest.encode_to_vec();
@@ -230,7 +241,12 @@ impl Registry {
                 // Init local repo
                 let local = LocalRepo::init(&self.cache_root, id, format)?;
 
-                let state = RepoState::default();
+                let state = RepoState {
+                    manifest_version: Some(meta.version.as_str().to_string()),
+                    revision: manifest.revision,
+                    packs_revision: manifest.revision,
+                    ..Default::default()
+                };
                 save_state(local.path(), &state)?;
 
                 let handle = RepoHandle::new(
diff --git a/crates/walgit-wal/src/remote.rs b/crates/walgit-wal/src/remote.rs
index 8ea697f..6d598f7 100644
--- a/crates/walgit-wal/src/remote.rs
+++ b/crates/walgit-wal/src/remote.rs
@@ -10,7 +10,7 @@
 //! from GCS by range reads with a local block cache". It is used by the web
 //! API (`Need::Objects` on a too-large repo) which faults the objects a git
 //! command will touch into the local loose store and then runs the command
-//! unchanged; upload-pack does not use it (clones go through bundle-uri).
+//! unchanged. Remote fetch uses dynamic object traversal.
 
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
@@ -18,7 +18,7 @@ use std::sync::atomic::{AtomicU64, Ordering};
 use bytes::Bytes;
 use gix_pack::data::entry::Header;
 use tracing::Instrument;
-use walgit_proto::v1::{Manifest, PackRef};
+use walgit_proto::v1::Manifest;
 use walgit_store::{GetOptions, GetResult, ObjectStore, Prefixed};
 
 use crate::error::WalError;
@@ -158,118 +158,24 @@ impl RemotePacks {
         object_cache_bytes: u64,
         reporter: &Reporter,
     ) -> Result<Self, WalError> {
-        let dir = idx_dir(repo_dir);
-        tokio::fs::create_dir_all(&dir).await?;
-        // History packs are always local copies: no remote index for them.
+        let retained = &manifest.packs;
+        // Only redundant historical accelerators may be omitted. Authoritative
+        // history segments are the sole home of their objects on refs-only hosts.
         let manifest = {
             let mut m = manifest.clone();
-            m.packs
-                .retain(|p| p.kind != walgit_proto::v1::PackKind::History as i32);
+            m.packs.retain(|p| {
+                p.kind != walgit_proto::v1::PackKind::History as i32
+                    || !p.pack_groups.is_empty()
+                    || p.derived_from.is_empty()
+            });
             m
         };
         let manifest = &manifest;
-        let total_idx: u64 = manifest.packs.iter().map(|p| p.idx_size).sum();
-        let live: std::collections::HashSet<&str> =
-            manifest.packs.iter().map(|p| p.checksum.as_str()).collect();
-        // Drop indexes of packs no longer live (compaction superseded them).
-        if let Ok(mut rd) = tokio::fs::read_dir(&dir).await {
-            while let Ok(Some(e)) = rd.next_entry().await {
-                let name = e.file_name().to_string_lossy().to_string();
-                if let Some(stem) = name.strip_suffix(".idx")
-                    && !live.contains(stem)
-                {
-                    let _ = tokio::fs::remove_file(e.path()).await;
-                }
-            }
-        }
-        // An index the Serve level already installed (linked/local base) is
-        // the same bytes: hard-link it instead of downloading 2 GB twice onto
-        // the same tmpfs (and vice versa, see sync::link_and_install_pack).
-        for p in &manifest.packs {
-            let dest = dir.join(format!("{}.idx", p.checksum));
-            if dest.exists() {
-                continue;
-            }
-            let installed = repo_dir
-                .join("objects")
-                .join("pack")
-                .join(format!("pack-{}.idx", p.checksum));
-            if installed.is_file() && std::fs::hard_link(&installed, &dest).is_err() {
-                let _ = std::fs::copy(&installed, &dest);
-            }
-        }
-        let done = Arc::new(AtomicU64::new(0));
-        let missing: Vec<&PackRef> = manifest
-            .packs
-            .iter()
-            .filter(|p| !dir.join(format!("{}.idx", p.checksum)).exists())
-            .collect();
-        if !missing.is_empty() {
-            reporter.notice(format!(
-                "Pack set is {} across {} pack(s): too large for this instance's disk, reading objects straight from the WAL. Downloading {} pack index(es) ({}).",
-                human_bytes(manifest.packs.iter().map(|p| p.pack_size).sum()),
-                manifest.packs.len(),
-                missing.len(),
-                human_bytes(missing.iter().map(|p| p.idx_size).sum()),
-            ));
-            let throttle = Arc::new(crate::progress::Throttle::new(
-                std::time::Duration::from_millis(250),
-            ));
-            let sem = Arc::new(tokio::sync::Semaphore::new(4));
-            let mut tasks = Vec::new();
-            for p in missing {
-                let sem = sem.clone();
-                let store = store.clone();
-                let dir = dir.clone();
-                let p = p.clone();
-                let done = done.clone();
-                let reporter = reporter.clone();
-                let throttle = throttle.clone();
-                tasks.push(tokio::spawn(async move {
-                    let _permit = sem
-                        .acquire()
-                        .await
-                        .map_err(|e| WalError::Corrupt(e.to_string()))?;
-                    let tmp = dir.join(format!("{}.idx.tmp", p.checksum));
-                    let dest = dir.join(format!("{}.idx", p.checksum));
-                    let cb = |delta: u64, _t: u64| {
-                        let all = done.fetch_add(delta, Ordering::Relaxed) + delta;
-                        if throttle.tick(false) {
-                            reporter.bar("Downloading pack indexes", all, Some(total_idx), "bytes");
-                        }
-                    };
-                    crate::sync::download_object(
-                        &store,
-                        &walgit_proto::keys::idx_key(&p.checksum),
-                        &tmp,
-                        (p.idx_size > 0).then_some(p.idx_size),
-                        Some(&cb),
-                    )
-                    .await?;
-                    tokio::fs::rename(&tmp, &dest).await?;
-                    Ok::<(), WalError>(())
-                }));
-            }
-            for t in tasks {
-                t.await.map_err(|e| WalError::Corrupt(e.to_string()))??;
-            }
-            reporter.bar(
-                "Downloading pack indexes",
-                total_idx,
-                Some(total_idx),
-                "bytes",
-            );
-        }
-        let mut packs = Vec::with_capacity(manifest.packs.len());
-        for p in &manifest.packs {
-            let path = dir.join(format!("{}.idx", p.checksum));
-            let idx = tokio::task::spawn_blocking({
-                let path = path.clone();
-                move || gix_pack::index::File::at(&path, hash)
-            })
-            .await
-            .map_err(|e| WalError::Corrupt(e.to_string()))?
-            .map_err(|e| WalError::Corrupt(format!("open pack index {}: {e}", path.display())))?;
+        let loaded =
+            crate::index_cache::load(&store, repo_dir, &manifest.packs, retained, hash, reporter)
+                .await?;
+        let mut packs = Vec::with_capacity(loaded.len());
+        for (p, idx) in loaded {
             let key = walgit_proto::keys::pack_key(&p.checksum);
             let size = if p.pack_size > 0 {
                 p.pack_size
diff --git a/crates/walgit-wal/src/snapshots.rs b/crates/walgit-wal/src/snapshots.rs
new file mode 100644
index 0000000..8b5eba7
--- /dev/null
+++ b/crates/walgit-wal/src/snapshots.rs
@@ -0,0 +1,262 @@
+//! Exact committed ref snapshots and coherent producer inputs.
+use std::sync::Arc;
+
+use prost::Message;
+use walgit_proto::v1::{Checkpoint, CheckpointRef, Manifest, RefSnapshot};
+use walgit_store::{ObjectStoreExt, Prefixed, PutMode, StoreError, Version};
+
+use crate::{RepoHandle, WalError};
+
+/// One committed generation, including the refs and policy used by a producer.
+#[derive(Clone)]
+pub struct PublicationView {
+    pub manifest: Arc<Manifest>,
+    pub version: Option<Version>,
+    pub refs: RefSnapshot,
+    pub config: Arc<walgit_config::Config>,
+}
+
+/// A request's already-synced manifest and name-indexed refs, captured together.
+/// Unlike producer snapshots, this does not materialize the full current ref list.
+pub struct FetchView {
+    pub manifest: Arc<Manifest>,
+    pub refs: walgit_git::RefView,
+    pub config: Arc<walgit_config::Config>,
+}
+
+/// Uploaded candidate. It acquires authority only when a manifest CAS names it.
+#[derive(Clone, Debug)]
+pub struct CoverageSnapshot {
+    pub(crate) key: String,
+    pub(crate) snapshot: RefSnapshot,
+    pub(crate) repo: String,
+}
+
+impl CoverageSnapshot {
+    pub fn key(&self) -> &str {
+        &self.key
+    }
+    pub fn snapshot(&self) -> &RefSnapshot {
+        &self.snapshot
+    }
+}
+
+/// Reject unsupported durable formats instead of guessing their meaning. This
+/// cannot fence an older binary that never enforced `format_version`.
+pub fn validate_manifest(manifest: &Manifest) -> Result<(), WalError> {
+    if manifest.format_version != walgit_proto::WAL_FORMAT_VERSION {
+        return Err(WalError::Corrupt(format!(
+            "unsupported manifest format {}",
+            manifest.format_version
+        )));
+    }
+    if !matches!(manifest.object_format.as_str(), "sha1" | "sha256") {
+        return Err(WalError::Corrupt(
+            "unsupported manifest object format".into(),
+        ));
+    }
+    if let Some(cp) = &manifest.checkpoint
+        && (cp.seq > manifest.head_seq || cp.key.is_empty())
+    {
+        return Err(WalError::Corrupt(
+            "invalid committed checkpoint descriptor".into(),
+        ));
+    }
+    Ok(())
+}
+
+pub(crate) async fn put_snapshot(
+    store: &Prefixed,
+    key: &str,
+    bytes: Vec<u8>,
+) -> Result<(), WalError> {
+    match store.put_bytes(key, bytes.clone(), PutMode::Create).await {
+        Ok(_) => Ok(()),
+        Err(StoreError::PreconditionFailed { .. }) => {
+            let (_, existing) = store
+                .get_bytes(key)
+                .await?
+                .ok_or_else(|| WalError::Corrupt(format!("snapshot disappeared: {key}")))?;
+            if existing.as_ref() != bytes {
+                return Err(WalError::Corrupt(format!(
+                    "snapshot content mismatch: {key}"
+                )));
+            }
+            Ok(())
+        }
+        Err(e) => Err(e.into()),
+    }
+}
+
+pub(crate) async fn read_snapshot(
+    store: &Prefixed,
+    key: &str,
+    seq: u64,
+    format: &str,
+) -> Result<RefSnapshot, WalError> {
+    let (_, bytes) = store
+        .get_bytes(key)
+        .await?
+        .ok_or_else(|| WalError::Corrupt(format!("missing committed refs snapshot {key}")))?;
+    let mut snapshot = if key.starts_with("checkpoints/refs/") {
+        walgit_proto::snapshot::decode_verified(key, &bytes)
+            .map_err(|e| WalError::Corrupt(format!("refs snapshot: {e}")))?
+    } else {
+        // Old snapshots did not consistently carry seq/object_format. The
+        // committed checkpoint supplies those facts; never infer its refs key.
+        let mut s = RefSnapshot::decode(bytes.as_ref())
+            .map_err(|e| WalError::Corrupt(format!("refs snapshot decode: {e}")))?;
+        if s.seq == 0 {
+            s.seq = seq;
+            s.object_format = format.to_string();
+        }
+        if s.object_format.is_empty() {
+            s.object_format = format.to_string();
+        }
+        walgit_proto::snapshot::validate(&s)
+            .map_err(|e| WalError::Corrupt(format!("refs snapshot: {e}")))?;
+        s
+    };
+    if snapshot.seq != seq || snapshot.object_format != format {
+        return Err(WalError::Corrupt(format!(
+            "refs snapshot generation/format mismatch: {key}"
+        )));
+    }
+    snapshot.created_at = None;
+    Ok(snapshot)
+}
+
+pub(crate) async fn checkpoint_snapshot(
+    store: &Prefixed,
+    cp: &CheckpointRef,
+    format: &str,
+) -> Result<RefSnapshot, WalError> {
+    let key = if cp.refs_key.is_empty() {
+        let (_, bytes) = store
+            .get_bytes(&cp.key)
+            .await?
+            .ok_or_else(|| WalError::Corrupt(format!("missing committed checkpoint {}", cp.key)))?;
+        let checkpoint = Checkpoint::decode(bytes.as_ref())
+            .map_err(|e| WalError::Corrupt(format!("checkpoint decode: {e}")))?;
+        if checkpoint.seq != cp.seq
+            || checkpoint.object_format != format
+            || checkpoint.refs_key.is_empty()
+        {
+            return Err(WalError::Corrupt("checkpoint descriptor mismatch".into()));
+        }
+        checkpoint.refs_key
+    } else {
+        cp.refs_key.clone()
+    };
+    read_snapshot(store, &key, cp.seq, format).await
+}
+
+impl RepoHandle {
+    pub async fn fetch_view(&self) -> Result<FetchView, WalError> {
+        let _sync = self.sync_mutex.lock().await;
+        let manifest = self.manifest();
+        let local = self.local.clone();
+        let refs = tokio::task::spawn_blocking(move || local.ref_view())
+            .await
+            .map_err(|e| WalError::Corrupt(e.to_string()))??;
+        let config = self.validated_config_for_manifest(&manifest)?;
+        Ok(FetchView {
+            manifest,
+            refs,
+            config,
+        })
+    }
+
+    /// Read exactly the descriptor in the request's captured manifest. Never
+    /// search a newer manifest by sequence or substitute another candidate key.
+    pub async fn read_coverage_snapshot(
+        &self,
+        view: &FetchView,
+        key: &str,
+        seq: u64,
+    ) -> Result<RefSnapshot, WalError> {
+        if view.manifest.repo != self.id.to_string()
+            || !view
+                .manifest
+                .packs
+                .iter()
+                .flat_map(|p| &p.group_coverages)
+                .any(|p| p.refs_key == key && p.covers_seq == seq)
+        {
+            return Err(WalError::Invalid(
+                "snapshot is outside captured coverage authority".into(),
+            ));
+        }
+        read_snapshot(&self.store, key, seq, &view.manifest.object_format).await
+    }
+
+    /// Revalidate and capture one committed manifest/token/refs/policy view.
+    /// No pack materialization, and no refs lock survives the returned value.
+    pub async fn publication_view(&self) -> Result<PublicationView, WalError> {
+        let _sync = self.sync_mutex.lock().await;
+        self.sync_locked_inner(&tracing::Span::current()).await?;
+        let (manifest, version) = self.manifest_pair();
+        let local = self.local.clone();
+        let refs = tokio::task::spawn_blocking(move || local.refs())
+            .await
+            .map_err(|e| WalError::Corrupt(e.to_string()))??;
+        let mut snapshot: RefSnapshot = refs.into();
+        snapshot.seq = manifest.head_seq;
+        snapshot.object_format.clone_from(&manifest.object_format);
+        snapshot.created_at = None;
+        let refs = walgit_proto::snapshot::canonicalize(&snapshot)
+            .map_err(|e| WalError::Corrupt(e.to_string()))?;
+        let config = self.validated_config_for_manifest(&manifest)?;
+        Ok(PublicationView {
+            manifest,
+            version,
+            refs,
+            config,
+        })
+    }
+
+    /// Upload immutable refs prepared from a coherent committed producer view.
+    pub async fn prepare_coverage_snapshot(
+        &self,
+        view: &PublicationView,
+    ) -> Result<CoverageSnapshot, WalError> {
+        if view.manifest.repo != self.id.to_string()
+            || view.refs.seq != view.manifest.head_seq
+            || view.refs.object_format != view.manifest.object_format
+        {
+            return Err(WalError::Invalid(
+                "coverage view does not match repository/generation".into(),
+            ));
+        }
+        let bytes = walgit_proto::snapshot::encode(&view.refs)
+            .map_err(|e| WalError::Invalid(e.to_string()))?;
+        let key = walgit_proto::snapshot::key(&bytes);
+        put_snapshot(&self.store, &key, bytes).await?;
+        Ok(CoverageSnapshot {
+            key,
+            snapshot: view.refs.clone(),
+            repo: view.manifest.repo.clone(),
+        })
+    }
+
+    /// Resolve only an exact descriptor already named by the live manifest.
+    /// An uncommitted candidate at the same sequence is never a substitute.
+    pub async fn pin_coverage_refs(&self, seq: u64) -> Result<RefSnapshot, WalError> {
+        let manifest = self.manifest();
+        if let Some(key) = manifest
+            .packs
+            .iter()
+            .flat_map(|p| &p.group_coverages)
+            .find(|c| c.covers_seq == seq)
+            .map(|c| c.refs_key.as_str())
+        {
+            return read_snapshot(&self.store, key, seq, &manifest.object_format).await;
+        }
+        if let Some(cp) = &manifest.checkpoint
+            && cp.seq == seq
+        {
+            return checkpoint_snapshot(&self.store, cp, &manifest.object_format).await;
+        }
+        crate::log_reader::refs_at_seq(self, seq).await
+    }
+}
diff --git a/crates/walgit-wal/src/sync.rs b/crates/walgit-wal/src/sync.rs
index c9134e9..ecaa7ff 100644
--- a/crates/walgit-wal/src/sync.rs
+++ b/crates/walgit-wal/src/sync.rs
@@ -7,7 +7,7 @@ use crate::store_proto::{get_message, get_message_if_changed};
 use tracing::Instrument;
 use walgit_git::LocalRepo;
 use walgit_proto::keys;
-use walgit_proto::v1::{EntryKind, LogEntry, Manifest, PackRef, RefSnapshot};
+use walgit_proto::v1::{EntryKind, LogEntry, Manifest, PackRef};
 use walgit_store::{GetOptions, GetResult, ObjectStore, Prefixed, Version};
 
 /// A read guard held for the lifetime of a request. While any guard is alive
@@ -91,7 +91,7 @@ pub(crate) async fn freshness_check(
     store: &Prefixed,
     known: Option<&Version>,
 ) -> Result<SyncOutcome, WalError> {
-    match known {
+    let outcome = match known {
         Some(v) => match get_message_if_changed::<Manifest>(store, keys::MANIFEST, v).await? {
             None => Ok(SyncOutcome::Unchanged),
             Some((meta, manifest)) => Ok(SyncOutcome::Changed {
@@ -106,7 +106,11 @@ pub(crate) async fn freshness_check(
                 manifest: std::sync::Arc::new(manifest),
             }),
         },
+    }?;
+    if let SyncOutcome::Changed { manifest, .. } = &outcome {
+        crate::validate_manifest(manifest)?;
     }
+    Ok(outcome)
 }
 
 /// Download a pack+idx from the store and install it into the local repo.
@@ -204,7 +208,7 @@ pub(crate) async fn download_and_install_pack(
         .install_pack(&pack_path, &idx_path, &extra)
         .instrument(span.clone())
         .await?;
-    if pack.kind == walgit_proto::v1::PackKind::History as i32 {
+    if pack.kind == walgit_proto::v1::PackKind::History as i32 && pack.pack_groups.is_empty() {
         local.mark_history_pack(&oid, &pack.derived_from).await?;
         tracing::info!(checksum = %checksum, base = %pack.derived_from, bytes = pack.pack_size, "history pack installed (commits + trees local)");
     }
@@ -228,6 +232,7 @@ pub(crate) async fn link_and_install_pack(
     pack: &PackRef,
     tmp_dir: &std::path::Path,
     target: &std::path::Path,
+    reporter: &crate::progress::Reporter,
 ) -> Result<(), WalError> {
     let checksum = &pack.checksum;
     let oid = gix_hash::ObjectId::from_hex(checksum.as_bytes())
@@ -240,7 +245,6 @@ pub(crate) async fn link_and_install_pack(
     let idx_path = tmp_dir.join(format!("pack-{checksum}.idx"));
     // The remote reader may already hold this index (web API on the same
     // instance): same bytes, hard-link instead of a second 2 GB download.
-    let remote_idx = crate::remote::idx_dir(local.path()).join(format!("{checksum}.idx"));
     let mut extra = Vec::new();
     let mut side_futs = Vec::new();
     // Idx + rev + bitmap + commit-graph in one round (each already striped).
@@ -257,9 +261,14 @@ pub(crate) async fn link_and_install_pack(
                 .instrument(span.clone()),
         );
     }
-    let idx_r = if remote_idx.is_file()
-        && (std::fs::hard_link(&remote_idx, &idx_path).is_ok()
-            || std::fs::copy(&remote_idx, &idx_path).is_ok())
+    let idx_r = if crate::index_cache::reuse(
+        local.path(),
+        pack,
+        local.object_format().kind(),
+        idx_path.clone(),
+        reporter,
+    )
+    .await?
     {
         tracing::info!(checksum = %checksum, "pack index reused from the remote reader");
         let side_rs = futures::future::join_all(side_futs).await;
@@ -327,6 +336,34 @@ fn nonzero(n: u64) -> Option<u64> {
     (n > 0).then_some(n)
 }
 
+async fn write_complete_body(
+    key: &str,
+    dest: &std::path::Path,
+    mut body: walgit_store::ByteStream,
+    size: u64,
+    report: &(impl Fn(u64) + Sync),
+) -> Result<(), WalError> {
+    use futures::StreamExt;
+    let mut received = 0u64;
+    let mut file = tokio::fs::File::create(dest).await?;
+    while let Some(chunk) = body.next().await {
+        let chunk = chunk?;
+        received = received.saturating_add(chunk.len() as u64);
+        if received > size {
+            return Err(WalError::Corrupt(format!("oversized body for {key}")));
+        }
+        tokio::io::AsyncWriteExt::write_all(&mut file, &chunk).await?;
+        report(chunk.len() as u64);
+    }
+    if received != size {
+        return Err(WalError::Corrupt(format!(
+            "short body for {key}: expected {size}, got {received}"
+        )));
+    }
+    tokio::io::AsyncWriteExt::flush(&mut file).await?;
+    Ok(())
+}
+
 pub(crate) async fn download_object(
     store: &Prefixed,
     key: &str,
@@ -361,16 +398,14 @@ pub(crate) async fn download_object(
     if size <= CHUNK {
         let res = store.get(key, GetOptions::default()).await?;
         return match res {
-            GetResult::Object { body, .. } => {
-                let mut file = tokio::fs::File::create(dest).await?;
-                let mut body = body;
-                while let Some(chunk) = body.next().await {
-                    let chunk = chunk?;
-                    tokio::io::AsyncWriteExt::write_all(&mut file, &chunk).await?;
-                    report(chunk.len() as u64);
+            GetResult::Object { meta, body } => {
+                if meta.size != size {
+                    return Err(WalError::Corrupt(format!(
+                        "size changed for {key}: expected {size}, got {}",
+                        meta.size
+                    )));
                 }
-                tokio::io::AsyncWriteExt::flush(&mut file).await?;
-                Ok(())
+                write_complete_body(key, dest, body, size, &report).await
             }
             GetResult::NotModified { .. } => {
                 Err(WalError::Corrupt(format!("unexpected 304 for {key}")))
@@ -438,7 +473,6 @@ pub(crate) async fn apply_delta(
     new_manifest: &Manifest,
     new_version: &Version,
 ) -> Result<(), WalError> {
-    let store = &handle.store;
     let local = &handle.local;
     let current_state = handle.state.lock().clone();
 
@@ -451,11 +485,15 @@ pub(crate) async fn apply_delta(
     // carry none, the object always does.
     handle.learn_checkpoint_times().await?;
     if need_checkpoint_load {
-        let refs_key = keys::checkpoint_refs_key(checkpoint_seq);
-        if let Some((_, snap)) = get_message::<RefSnapshot>(store, &refs_key).await? {
-            local.load_ref_snapshot(&snap)?;
-            handle.state.lock().applied_seq = checkpoint_seq;
-        }
+        let cp = new_manifest
+            .checkpoint
+            .as_ref()
+            .ok_or_else(|| WalError::Corrupt("missing checkpoint descriptor".into()))?;
+        let snap =
+            crate::snapshots::checkpoint_snapshot(&handle.store, cp, &new_manifest.object_format)
+                .await?;
+        local.load_ref_snapshot(&snap)?;
+        handle.state.lock().applied_seq = checkpoint_seq;
     }
 
     // Replay log entries (refs, and superseded-pack bookkeeping) from
@@ -469,8 +507,15 @@ pub(crate) async fn apply_delta(
     {
         let mut state = handle.state.lock();
         state.manifest_version = Some(new_version.as_str().to_string());
+        let held = handle.manifest();
+        let ready = state.packs_ready()
+            && state.revision == held.revision
+            && held.packs == new_manifest.packs;
         state.applied_seq = head_seq;
         state.revision = new_manifest.revision;
+        if ready {
+            state.packs_revision = new_manifest.revision;
+        }
     }
     crate::state::save_state(local.path(), &handle.state.lock().clone())?;
     local.refresh_async().await?;
@@ -499,6 +544,8 @@ pub(crate) async fn reconcile_packs_inner(
 ) -> Result<(), WalError> {
     let store = &handle.store;
     let local = &handle.local;
+    let segmented = manifest.packs.iter().any(|p| !p.pack_groups.is_empty());
+    local.set_segmented_midx_mode(segmented);
     // Test hook: simulate an unknown blocking call inside the install path
     // (what prod had: 2.6–43 s runtime stalls during materialization). With
     // the bulk runtime this only delays bulk work.
@@ -580,7 +627,11 @@ pub(crate) async fn reconcile_packs_inner(
     // be served from the linked/remote base right away. They are installed by
     // a background task (`RepoHandle::spawn_history_pack_install`) so the
     // first request on an instance never waits for a 7.5 GB download.
-    let is_history = |p: &PackRef| p.kind == walgit_proto::v1::PackKind::History as i32;
+    let is_history = |p: &PackRef| {
+        p.kind == walgit_proto::v1::PackKind::History as i32
+            && p.pack_groups.is_empty()
+            && !p.derived_from.is_empty()
+    };
     let deferred_history: Vec<PackRef> = manifest
         .packs
         .iter()
@@ -709,7 +760,8 @@ pub(crate) async fn reconcile_packs_inner(
                 };
                 match link_to {
                     Some(target) => {
-                        link_and_install_pack(&store, &local, &p, &tmp_dir, &target).await
+                        link_and_install_pack(&store, &local, &p, &tmp_dir, &target, &reporter)
+                            .await
                     }
                     None => {
                         download_and_install_pack(&store, &local, &p, &tmp_dir, Some(&cb)).await
@@ -767,6 +819,44 @@ pub(crate) async fn reconcile_packs_inner(
         handle.state.lock().pending_pack_removals = still_pending;
     }
 
+    if segmented {
+        if remote_served.is_empty() {
+            let ids = manifest
+                .packs
+                .iter()
+                .map(|p| {
+                    gix_hash::ObjectId::from_hex(p.checksum.as_bytes())
+                        .map_err(|e| WalError::Corrupt(format!("pack checksum: {e}")))
+                })
+                .collect::<Result<Vec<_>, _>>()?;
+            let pin = handle.pin_local_objects().await;
+            let repo = local.clone();
+            let (refs, pin) = tokio::task::spawn_blocking(move || {
+                let refs = repo.refs();
+                (refs, pin)
+            })
+            .await
+            .map_err(|e| WalError::Corrupt(format!("MIDX refs: {e}")))?;
+            let refs = refs?;
+            if let Some(commit) = refs.refs.iter().find(|r| r.name.starts_with("refs/heads/")) {
+                let oid = gix_hash::ObjectId::from_hex(commit.oid.as_bytes())
+                    .map_err(|e| WalError::Corrupt(format!("MIDX root: {e}")))?;
+                // Bitmap verification is strict; a concurrent ref move can
+                // legitimately outpace the captured pack inventory. Failure
+                // leaves ordinary non-bitmap object traversal available.
+                if let Err(error) = local.write_verified_midx(&ids, oid, pin).await {
+                    tracing::warn!(repo = %handle.id, %error, "segmented MIDX unavailable; ordinary traversal remains active");
+                }
+            }
+        } else {
+            // A MIDX bitmap over absent pack bytes is not native-readable.
+            // Invalidation never queues a writer behind long-lived readers.
+            if let Ok(_guard) = handle.rw.try_write() {
+                local.invalidate_midx()?;
+            }
+        }
+    }
+
     {
         let mut state = handle.state.lock();
         state.packs_revision = manifest.revision;
@@ -811,7 +901,11 @@ pub(crate) async fn maintain_commit_graph(
     // After a base change every non-base pack must be re-added (the old chain
     // layers were dropped); otherwise only what was just installed.
     // History packs hold the base's commits, already covered by its layer.
-    let is_history = |p: &&PackRef| p.kind == walgit_proto::v1::PackKind::History as i32;
+    let is_history = |p: &&PackRef| {
+        p.kind == walgit_proto::v1::PackKind::History as i32
+            && p.pack_groups.is_empty()
+            && !p.derived_from.is_empty()
+    };
     let candidates: Vec<&PackRef> = if base_changed {
         manifest
             .packs
@@ -1049,6 +1143,30 @@ mod download_tests {
     use super::download_object;
     use walgit_store::{ObjectStoreExt, Prefixed, PutMode, memory::MemoryStore};
 
+    #[tokio::test]
+    async fn clean_early_eof_is_rejected_and_retry_replaces_partial_bytes() -> anyhow::Result<()> {
+        let dir = tempfile::tempdir()?;
+        let dest = dir.path().join("download.tmp");
+        let body = |bytes: &'static [u8]| -> walgit_store::ByteStream {
+            Box::pin(futures::stream::once(async move {
+                Ok(bytes::Bytes::from_static(bytes))
+            }))
+        };
+        assert!(
+            super::write_complete_body("pack", &dest, body(b"short"), 8, &|_| {})
+                .await
+                .is_err()
+        );
+        assert!(
+            super::write_complete_body("pack", &dest, body(b"too many bytes"), 8, &|_| {})
+                .await
+                .is_err()
+        );
+        super::write_complete_body("pack", &dest, body(b"complete"), 8, &|_| {}).await?;
+        assert_eq!(std::fs::read(&dest)?, b"complete");
+        Ok(())
+    }
+
     #[tokio::test]
     async fn striped_download_matches_source() {
         // > CHUNK (32 MiB) so the ranged/striped path runs, with a ragged tail.
diff --git a/crates/walgit-wal/tests/coverage.rs b/crates/walgit-wal/tests/coverage.rs
new file mode 100644
index 0000000..99b6f25
--- /dev/null
+++ b/crates/walgit-wal/tests/coverage.rs
@@ -0,0 +1,495 @@
+#![allow(clippy::unwrap_used, clippy::field_reassign_with_default)]
+//! Authority tests use small manifest fixtures. Retirement tests also use real
+//! Git indexes to exercise conservation independently of producer assertions.
+use prost::Message;
+use std::sync::Arc;
+use walgit_config::{Config, PackGroupConfig, PackGroupKind};
+use walgit_git::{ObjectFormat, RepoId};
+use walgit_proto::v1::{
+    Checkpoint, CheckpointRef, Manifest, PackAudience, PackGroupCoverage, PackKind, PackRef, Ref,
+    RefSnapshot,
+};
+use walgit_store::{ObjectStoreExt, PutMode, memory::MemoryStore};
+use walgit_wal::{CoverageSnapshot, PackClassification, Registry, RepoHandle};
+
+fn config(dir: &std::path::Path) -> Config {
+    let mut cfg = Config::default();
+    cfg.cache.dir = dir.to_path_buf();
+    cfg.wal.freshness_ttl = std::time::Duration::ZERO;
+    cfg
+}
+fn id() -> RepoId {
+    RepoId::new("test", "coverage").unwrap()
+}
+fn pack(n: u8) -> PackRef {
+    PackRef {
+        checksum: format!("{n:040x}"),
+        seq: 1,
+        kind: PackKind::Objects as i32,
+        ..Default::default()
+    }
+}
+async fn seed(store: &Arc<MemoryStore>, manifest: &Manifest) {
+    store
+        .put_bytes(
+            &format!("{}manifest.pb", id().store_prefix()),
+            manifest.encode_to_vec(),
+            PutMode::Overwrite,
+        )
+        .await
+        .unwrap();
+}
+async fn fresh(store: &Arc<MemoryStore>, cfg: Config) -> Arc<RepoHandle> {
+    Registry::new(store.clone(), Arc::new(cfg))
+        .open(&id())
+        .await
+        .unwrap()
+}
+fn classify(
+    pack: &PackRef,
+    group: &str,
+    policy: &str,
+    snapshot: &CoverageSnapshot,
+    members: &[PackRef],
+) -> PackClassification {
+    PackClassification {
+        checksum: pack.checksum.clone(),
+        kind: PackKind::Objects as i32,
+        audience: PackAudience::Code as i32,
+        ref_policy: policy.to_string(),
+        pack_groups: vec![group.to_string()],
+        covers_seq: snapshot.snapshot().seq,
+        coverage_refs_key: snapshot.key().to_string(),
+        group_coverages: vec![PackGroupCoverage {
+            group: group.to_string(),
+            ref_policy: policy.to_string(),
+            covers_seq: snapshot.snapshot().seq,
+            packs: members.iter().map(|p| p.checksum.clone()).collect(),
+            refs_key: snapshot.key().to_string(),
+        }],
+    }
+}
+
+async fn real_pack(store: &Arc<MemoryStore>, blobs: &[&str]) -> PackRef {
+    use std::io::Write;
+    use std::process::{Command, Stdio};
+    let dir = tempfile::tempdir().unwrap();
+    let run = |args: &[&str], input: &str| {
+        let mut child = Command::new("git")
+            .arg("-C")
+            .arg(dir.path())
+            .args(args)
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        child
+            .stdin
+            .take()
+            .unwrap()
+            .write_all(input.as_bytes())
+            .unwrap();
+        let output = child.wait_with_output().unwrap();
+        assert!(
+            output.status.success(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+        String::from_utf8(output.stdout).unwrap().trim().to_owned()
+    };
+    run(&["init", "--bare"], "");
+    let objects = blobs
+        .iter()
+        .map(|blob| run(&["hash-object", "-w", "--stdin"], blob))
+        .collect::<Vec<_>>()
+        .join("\n");
+    let checksum = run(
+        &["pack-objects", "objects/pack/pack"],
+        &format!("{objects}\n"),
+    );
+    let pack = std::fs::read(
+        dir.path()
+            .join(format!("objects/pack/pack-{checksum}.pack")),
+    )
+    .unwrap();
+    let index =
+        std::fs::read(dir.path().join(format!("objects/pack/pack-{checksum}.idx"))).unwrap();
+    let descriptor = PackRef {
+        checksum: checksum.clone(),
+        pack_size: pack.len() as u64,
+        idx_size: index.len() as u64,
+        object_count: blobs.len() as u64,
+        ..Default::default()
+    };
+    for (ext, bytes) in [("pack", pack), ("idx", index)] {
+        store
+            .put_bytes(
+                &format!("{}wal/{checksum}.{ext}", id().store_prefix()),
+                bytes,
+                PutMode::Overwrite,
+            )
+            .await
+            .unwrap();
+    }
+    descriptor
+}
+
+// Seed an exact committed checkpoint, including intentionally damaged ref
+// provenance, without using the publication API whose admission is under test.
+async fn seed_next_refs(store: &Arc<MemoryStore>, h: &RepoHandle, refs: Vec<Ref>) {
+    let mut manifest = (*h.manifest()).clone();
+    let seq = manifest.head_seq + 1;
+    let snapshot = RefSnapshot {
+        seq,
+        object_format: "sha1".into(),
+        refs,
+        ..Default::default()
+    };
+    let refs_key = format!("checkpoints/{seq}/refs.pb");
+    store
+        .put_bytes(
+            &format!("{}{refs_key}", id().store_prefix()),
+            snapshot.encode_to_vec(),
+            PutMode::Create,
+        )
+        .await
+        .unwrap();
+    manifest.head_seq = seq;
+    manifest.min_seq = seq + 1;
+    manifest.log_segments.clear();
+    manifest.revision += 1;
+    manifest.checkpoint = Some(CheckpointRef {
+        seq,
+        key: format!("checkpoints/{seq}/checkpoint.pb"),
+        refs_key,
+        ..Default::default()
+    });
+    seed(store, &manifest).await;
+}
+
+#[tokio::test]
+async fn replacement_seal_requires_exact_outputs_and_keeps_inputs_until_success() {
+    let store = MemoryStore::shared();
+    let dir = tempfile::tempdir().unwrap();
+    let registry = Registry::new(store.clone(), Arc::new(config(dir.path())));
+    let h = registry.create(&id(), ObjectFormat::Sha1).await.unwrap();
+    h.publish_settings("", "test", "generation").await.unwrap();
+    let mut manifest = (*h.manifest()).clone();
+    let input = real_pack(&store, &["conserved"]).await;
+    let mut output = real_pack(&store, &["conserved", "extra"]).await;
+    output.published_at = Some(walgit_proto::time::now());
+    output.pack_groups = vec!["_retained".into()];
+    output.audience = PackAudience::Retained as i32;
+    output.ref_policy = h.effective_config().refs.policy_identity();
+    manifest.packs = vec![input.clone()];
+    manifest.revision += 1;
+    seed(&store, &manifest).await;
+    let captured = h.publication_view().await.unwrap();
+    // The producer commits output bytes additively before asking to retire inputs.
+    manifest.packs.push(output.clone());
+    manifest.revision += 1;
+    seed(&store, &manifest).await;
+    let lease = tokio::sync::Mutex::new(
+        walgit_store::coord::try_acquire(
+            store.clone(),
+            "test-seal-lease",
+            "test",
+            "seal",
+            std::time::Duration::from_mins(1),
+        )
+        .await
+        .unwrap()
+        .unwrap(),
+    );
+    let inputs = vec![input.checksum.clone()];
+    let mut wrong = output.clone();
+    wrong.idx_size += 1;
+    let error = h
+        .seal_pack_replacement(&captured, &inputs, &[wrong], &[], &lease)
+        .await
+        .unwrap_err();
+    assert!(
+        error.to_string().contains("output descriptor changed"),
+        "{error}"
+    );
+    assert!(
+        h.manifest()
+            .packs
+            .iter()
+            .any(|p| p.checksum == input.checksum)
+    );
+    assert!(h.manifest().retired_packs.is_empty());
+    // Even plausible descriptors and already-committed bytes cannot justify
+    // dropping an unreachable indexed object from the captured input.
+    let lossy = real_pack(&store, &["unrelated"]).await;
+    manifest.packs.push(lossy.clone());
+    manifest.revision += 1;
+    seed(&store, &manifest).await;
+    let error = h
+        .seal_pack_replacement(
+            &captured,
+            &inputs,
+            std::slice::from_ref(&lossy),
+            &[],
+            &lease,
+        )
+        .await
+        .unwrap_err();
+    assert!(
+        error.to_string().contains("loses indexed object"),
+        "{error}"
+    );
+    assert!(h.manifest().retired_packs.is_empty());
+    seed_next_refs(
+        &store,
+        &h,
+        vec![Ref {
+            name: "refs/heads/new-after-plan".into(),
+            oid: "a".repeat(40),
+            ..Default::default()
+        }],
+    )
+    .await;
+    let error = h
+        .seal_pack_replacement(&captured, &inputs, &[output.clone()], &[], &lease)
+        .await
+        .unwrap_err();
+    assert!(
+        error.to_string().contains("does not cover current tip"),
+        "{error}"
+    );
+    assert!(h.manifest().retired_packs.is_empty());
+    seed_next_refs(&store, &h, vec![]).await;
+    let seq = h
+        .seal_pack_replacement(&captured, &inputs, &[output.clone()], &[], &lease)
+        .await
+        .unwrap();
+    assert_eq!(h.manifest().packs, vec![output.clone(), lossy]);
+    assert!(
+        h.manifest()
+            .retired_packs
+            .iter()
+            .any(|p| p.checksum == input.checksum)
+    );
+    assert_eq!(
+        h.seal_pack_replacement(&captured, &inputs, &[output], &[], &lease)
+            .await
+            .unwrap(),
+        seq
+    );
+}
+
+#[tokio::test]
+async fn exact_snapshot_is_not_authority_until_cas_and_corruption_is_rejected() {
+    let store = MemoryStore::shared();
+    let d = tempfile::tempdir().unwrap();
+    let registry = Registry::new(store.clone(), Arc::new(config(d.path())));
+    let h = registry.create(&id(), ObjectFormat::Sha1).await.unwrap();
+    h.publish_settings("", "test", "generation one")
+        .await
+        .unwrap();
+    let mut manifest = (*h.manifest()).clone();
+    manifest.packs = vec![pack(1)];
+    manifest.revision += 1;
+    seed(&store, &manifest).await;
+    let view = h.publication_view().await.unwrap();
+    let snapshot = h.prepare_coverage_snapshot(&view).await.unwrap();
+    assert!(h.manifest().packs[0].group_coverages.is_empty());
+    let c = classify(
+        &pack(1),
+        "code",
+        &view.config.refs.policy_identity(),
+        &snapshot,
+        &[pack(1)],
+    );
+    assert!(
+        h.reclassify_packs(std::slice::from_ref(&c), &[])
+            .await
+            .is_err()
+    );
+    let d2 = tempfile::tempdir().unwrap();
+    let second = fresh(&store, config(d2.path())).await;
+    assert!(second.manifest().packs[0].group_coverages.is_empty());
+    h.reclassify_packs(&[c], std::slice::from_ref(&snapshot))
+        .await
+        .unwrap();
+    assert_eq!(h.manifest().head_seq, view.manifest.head_seq);
+    assert!(h.manifest().revision > view.manifest.revision);
+    assert_eq!(h.pin_coverage_refs(1).await.unwrap(), *snapshot.snapshot());
+    // A second reader must adopt metadata even with the same WAL head.
+    second.sync_refs().await.unwrap();
+    assert_eq!(second.manifest().packs[0].group_coverages.len(), 1);
+    store
+        .put_bytes(
+            &format!("{}{}", id().store_prefix(), snapshot.key()),
+            b"corrupt".to_vec(),
+            PutMode::Overwrite,
+        )
+        .await
+        .unwrap();
+    assert!(second.pin_coverage_refs(1).await.is_err());
+    // A duplicate candidate upload validates existing immutable bytes, too.
+    assert!(h.prepare_coverage_snapshot(&view).await.is_err());
+}
+
+#[tokio::test]
+async fn complete_same_generation_dependencies_and_live_scope_are_required() {
+    let store = MemoryStore::shared();
+    let d = tempfile::tempdir().unwrap();
+    let mut cfg = config(d.path());
+    cfg.refs.packfiles.insert(
+        "extra".into(),
+        PackGroupConfig {
+            kind: PackGroupKind::Code,
+            include: vec!["refs/heads/*".into()],
+            subtract: vec!["code".into()],
+        },
+    );
+    let registry = Registry::new(store.clone(), Arc::new(cfg.clone()));
+    let h = registry.create(&id(), ObjectFormat::Sha1).await.unwrap();
+    h.publish_settings("", "test", "generation one")
+        .await
+        .unwrap();
+    let mut manifest = (*h.manifest()).clone();
+    manifest.packs = vec![pack(1), pack(2)];
+    manifest.revision += 1;
+    seed(&store, &manifest).await;
+    let view = h.publication_view().await.unwrap();
+    let snapshot = h.prepare_coverage_snapshot(&view).await.unwrap();
+    let policy = cfg.refs.policy_identity();
+    let base = classify(&pack(1), "code", &policy, &snapshot, &[pack(1)]);
+    let extra = classify(&pack(2), "extra", &policy, &snapshot, &[pack(2)]);
+    assert!(
+        h.reclassify_packs(
+            std::slice::from_ref(&extra),
+            std::slice::from_ref(&snapshot)
+        )
+        .await
+        .is_err()
+    );
+    h.reclassify_packs(
+        &[base.clone(), extra.clone()],
+        std::slice::from_ref(&snapshot),
+    )
+    .await
+    .unwrap();
+    let mut wrong = base.clone();
+    wrong.covers_seq += 1;
+    assert!(
+        h.reclassify_packs(&[wrong], std::slice::from_ref(&snapshot))
+            .await
+            .is_err()
+    );
+    let mut missing = base.clone();
+    missing.group_coverages[0].packs.push(pack(99).checksum);
+    assert!(
+        h.reclassify_packs(&[missing], std::slice::from_ref(&snapshot))
+            .await
+            .is_err()
+    );
+    let mut stale = base.clone();
+    stale.ref_policy = "old-policy".into();
+    assert!(
+        h.reclassify_packs(&[stale], std::slice::from_ref(&snapshot))
+            .await
+            .is_err()
+    );
+    // Reclassification revokes dependent proofs rather than leaving them usable.
+    h.reclassify_packs(
+        &[PackClassification {
+            checksum: pack(1).checksum,
+            kind: PackKind::Objects as i32,
+            audience: PackAudience::Retained as i32,
+            pack_groups: vec!["_retained".into()],
+            ..Default::default()
+        }],
+        &[],
+    )
+    .await
+    .unwrap();
+    assert!(
+        h.manifest()
+            .packs
+            .iter()
+            .all(|p| p.group_coverages.is_empty())
+    );
+    assert!(h.reclassify_packs(&[extra], &[snapshot]).await.is_err());
+}
+
+#[tokio::test]
+async fn old_checkpoint_uses_its_committed_custom_key_including_sha256_placeholders() {
+    let store = MemoryStore::shared();
+    let d = tempfile::tempdir().unwrap();
+    let registry = Registry::new(store.clone(), Arc::new(config(d.path())));
+    let h = registry.create(&id(), ObjectFormat::Sha256).await.unwrap();
+    let snapshot = RefSnapshot {
+        seq: 0,
+        object_format: "sha1".into(),
+        refs: vec![Ref {
+            name: "refs/heads/main".into(),
+            oid: "a".repeat(64),
+            peeled: String::new(),
+        }],
+        head_target: "refs/heads/main".into(),
+        created_at: None,
+    };
+    let refs_key = "old/custom/refs.pb";
+    let cp_key = "old/custom/checkpoint.pb";
+    let cp = Checkpoint {
+        seq: 1,
+        object_format: "sha256".into(),
+        refs_key: refs_key.into(),
+        ref_count: 1,
+        ..Default::default()
+    };
+    for (key, bytes) in [
+        (refs_key, snapshot.encode_to_vec()),
+        (cp_key, cp.encode_to_vec()),
+    ] {
+        store
+            .put_bytes(
+                &format!("{}{key}", id().store_prefix()),
+                bytes,
+                PutMode::Create,
+            )
+            .await
+            .unwrap();
+    }
+    let mut manifest = (*h.manifest()).clone();
+    manifest.head_seq = 1;
+    manifest.min_seq = 2;
+    manifest.revision += 1;
+    manifest.checkpoint = Some(CheckpointRef {
+        seq: 1,
+        key: cp_key.into(),
+        ..Default::default()
+    });
+    seed(&store, &manifest).await;
+    let d2 = tempfile::tempdir().unwrap();
+    let reader = fresh(&store, config(d2.path())).await;
+    let view = reader.publication_view().await.unwrap();
+    assert_eq!(view.refs.object_format, "sha256");
+    assert_eq!(view.refs.refs[0].oid, "a".repeat(64));
+    assert_eq!(view.refs.seq, 1);
+}
+
+#[tokio::test]
+async fn canonical_checkpoint_and_strict_format_validation() {
+    let store = MemoryStore::shared();
+    let d = tempfile::tempdir().unwrap();
+    let registry = Registry::new(store.clone(), Arc::new(config(d.path())));
+    let h = registry.create(&id(), ObjectFormat::Sha1).await.unwrap();
+    h.publish_settings("", "test", "one").await.unwrap();
+    let cp = h.write_checkpoint().await.unwrap();
+    assert!(cp.refs_key.starts_with("checkpoints/refs/"));
+    assert!(cp.key.contains("attempts/"));
+    assert_eq!(h.pin_coverage_refs(cp.seq).await.unwrap().seq, cp.seq);
+    let mut manifest = (*h.manifest()).clone();
+    manifest.format_version = 999;
+    seed(&store, &manifest).await;
+    let d2 = tempfile::tempdir().unwrap();
+    let reader = Registry::new(store.clone(), Arc::new(config(d2.path())));
+    assert!(reader.open(&id()).await.is_err());
+    assert!(h.sync_refs().await.is_err());
+}
diff --git a/crates/walgit-wal/tests/coverage_config.rs b/crates/walgit-wal/tests/coverage_config.rs
new file mode 100644
index 0000000..590f363
--- /dev/null
+++ b/crates/walgit-wal/tests/coverage_config.rs
@@ -0,0 +1,50 @@
+//! Coverage producers must never broaden a saved policy after a host config change.
+use std::sync::Arc;
+
+use walgit_config::{Config, PackGroupConfig, PackGroupKind};
+use walgit_git::{ObjectFormat, RepoId};
+use walgit_wal::Registry;
+
+#[tokio::test]
+async fn invalid_saved_dependency_cannot_fall_back_to_broader_host_policy() {
+    let store = walgit_store::memory::MemoryStore::shared();
+    let old_cache = tempfile::tempdir().unwrap();
+    let new_cache = tempfile::tempdir().unwrap();
+    let mut old_config = Config::default();
+    old_config.cache.dir = old_cache.path().to_path_buf();
+    old_config.refs.packfiles.insert(
+        "base".into(),
+        PackGroupConfig {
+            kind: PackGroupKind::Code,
+            include: vec!["refs/heads/main".into()],
+            subtract: vec![],
+        },
+    );
+    old_config.validate().unwrap();
+    let id = RepoId::new("test", "policy-transition").unwrap();
+    let old = Registry::new(store.clone(), Arc::new(old_config));
+    let handle = old.create(&id, ObjectFormat::Sha1).await.unwrap();
+    let settings = "[refs]\nadvertise = [\"refs/heads/release\"]\n[refs.packfiles.code]\ninclude = [\"refs/heads/release\"]\nsubtract = [\"base\"]\n";
+    handle
+        .publish_settings(settings, "operator", "limit scope")
+        .await
+        .unwrap();
+    let original = handle.publication_view().await.unwrap();
+    assert_eq!(original.config.refs.advertise, ["refs/heads/release"]);
+    assert_eq!(
+        original.config.refs.packfiles["code"].include,
+        ["refs/heads/release"]
+    );
+
+    // The next host removes the group that the saved policy still subtracts.
+    // Its broad default code group must not become a replacement coverage basis.
+    let mut new_config = Config::default();
+    new_config.cache.dir = new_cache.path().to_path_buf();
+    new_config.validate().unwrap();
+    assert!(new_config.with_settings(settings).is_err());
+    let new = Registry::new(store, Arc::new(new_config));
+    let reopened = new.open(&id).await.unwrap();
+    assert!(reopened.publication_view().await.is_err());
+    assert_eq!(reopened.settings().unwrap().toml, settings);
+    assert_eq!(reopened.settings().unwrap().revision, 1);
+}
diff --git a/crates/walgit-wal/tests/settings_migration.rs b/crates/walgit-wal/tests/settings_migration.rs
new file mode 100644
index 0000000..698e6b3
--- /dev/null
+++ b/crates/walgit-wal/tests/settings_migration.rs
@@ -0,0 +1,62 @@
+//! Durable settings migrations never change the original audit document.
+use prost::Message;
+use std::sync::Arc;
+use walgit_config::Config;
+use walgit_git::{ObjectFormat, RepoId};
+use walgit_store::{ObjectStoreExt, PutMode};
+use walgit_wal::Registry;
+
+#[tokio::test]
+async fn obsolete_byte_policy_disables_maintenance_and_conflicts_fail_closed() {
+    let cases = [
+        (
+            "[compaction]\nfactor=3\ntrigger_packs=4\ntrigger_bytes='1MiB'\nengine='git'\n[upstream]\ngit='https://example.invalid/repository.git'\nfollow=['refs/heads/release']\n",
+            true,
+        ),
+        ("[compaction]\nretention_superseded='7d'\n", true),
+        (
+            "[compaction]\nfactor=3\n[packs]\ngeometric_factor=4\n",
+            false,
+        ),
+        ("[compaction]\ntrigger_packs=1\n", false),
+    ];
+    for (index, (saved, valid)) in cases.into_iter().enumerate() {
+        let store = walgit_store::memory::MemoryStore::shared();
+        let cache = tempfile::tempdir().unwrap();
+        let mut cfg = Config::default();
+        cfg.cache.dir = cache.path().to_owned();
+        assert!(
+            cfg.with_settings(saved).is_err(),
+            "new writes must reject obsolete sections"
+        );
+        let registry = Registry::new(store.clone(), Arc::new(cfg.clone()));
+        let id = RepoId::new("test", format!("migration-{index}")).unwrap();
+        let handle = registry.create(&id, ObjectFormat::Sha1).await.unwrap();
+        handle
+            .publish_settings("[packs]\nenabled=true\n", "operator", "seed")
+            .await
+            .unwrap();
+        let mut manifest = (*handle.manifest()).clone();
+        manifest.settings.as_mut().unwrap().toml = saved.into();
+        let key = format!("{}{}", id.store_prefix(), walgit_proto::keys::MANIFEST);
+        store
+            .put_bytes(&key, manifest.encode_to_vec(), PutMode::Overwrite)
+            .await
+            .unwrap();
+        let cold = tempfile::tempdir().unwrap();
+        cfg.cache.dir = cold.path().to_owned();
+        let reader = Registry::new(store, Arc::new(cfg));
+        let reopened = reader.open(&id).await.unwrap();
+        let effective = reopened.validated_effective_config();
+        assert_eq!(effective.is_ok(), valid, "{saved}: {effective:?}");
+        if let Ok(config) = effective {
+            assert!(!config.packs.enabled);
+            if index == 0 {
+                assert_eq!(config.packs.geometric_factor, 3);
+                assert_eq!(config.upstream.follow, ["refs/heads/release"]);
+            }
+        }
+        assert_eq!(reopened.settings().unwrap().toml, saved);
+        assert_eq!(reopened.settings().unwrap().revision, 1);
+    }
+}
diff --git a/crates/walgit-wal/tests/wal.rs b/crates/walgit-wal/tests/wal.rs
index 3779d85..ce85399 100644
--- a/crates/walgit-wal/tests/wal.rs
+++ b/crates/walgit-wal/tests/wal.rs
@@ -657,6 +657,32 @@ async fn test_compact_replays_on_other_registry() {
         );
     }
 
+    // Retirement is durable across restart and other manifest writers; static
+    // readers can finish previously issued downloads after compaction.
+    let retired = handle2.manifest().retired_packs.clone();
+    for old in &supersedes {
+        let checksum = old.to_string();
+        assert!(retired.iter().any(|p| p.checksum == checksum));
+        assert!(handle2.manifest().serves_pack(&checksum));
+        assert!(
+            store
+                .head(&format!(
+                    "{}{}",
+                    id.store_prefix(),
+                    walgit_proto::keys::pack_key(&checksum)
+                ))
+                .await
+                .unwrap()
+                .is_some()
+        );
+    }
+    handle2
+        .publish_settings("", "test", "preserve retirement")
+        .await
+        .unwrap();
+    handle2.write_checkpoint().await.unwrap();
+    assert_eq!(handle2.manifest().retired_packs, retired);
+
     // Objects should be readable
     let oid = gix_hash::ObjectId::from_hex(prev.as_bytes()).unwrap();
     assert!(
@@ -1163,6 +1189,7 @@ async fn test_serve_level_links_base_from_store_mount() {
                 shallow: vec![],
                 want_refs: vec![],
                 packfile_uris_protocols: vec![],
+                packfile_indexes: false,
             },
             &mut out,
         )
@@ -1529,6 +1556,7 @@ async fn test_serve_level_remote_serves_base_without_mount() {
                 shallow: vec![],
                 want_refs: vec![],
                 packfile_uris_protocols: vec![],
+                packfile_indexes: false,
             },
             &mut out,
             Some(&faulter),
@@ -1912,6 +1940,7 @@ async fn test_history_pack_keeps_tree_walks_local() {
         shallow: vec![],
         want_refs: vec![],
         packfile_uris_protocols: vec![],
+        packfile_indexes: false,
     };
     let mut out = Vec::new();
     let stats = handle2
@@ -2195,8 +2224,8 @@ async fn test_repo_settings_publish_and_effective_config() {
     let handle = registry.create(&id, ObjectFormat::Sha1).await.unwrap();
     assert!(handle.settings().is_none());
     assert_eq!(
-        handle.effective_config().bundles.min_commits,
-        handle.effective_config().bundles.min_commits
+        handle.effective_config().packs.geometric_factor,
+        make_config(cache.path(), 0).packs.geometric_factor
     );
 
     // Rejected: forbidden section; unknown key.
@@ -2215,12 +2244,12 @@ async fn test_repo_settings_publish_and_effective_config() {
 
     // Accepted.
     let rev = handle
-        .publish_settings("[bundles]\nmin_commits = 3\n", "alice", "small repo")
+        .publish_settings("[packs]\ngeometric_factor = 3\n", "alice", "small repo")
         .await
         .unwrap();
     assert_eq!(rev, 1);
     assert_eq!(handle.manifest().head_seq, 1);
-    assert_eq!(handle.effective_config().bundles.min_commits, 3);
+    assert_eq!(handle.effective_config().packs.geometric_factor, 3);
     let log = handle.read_log(1, None).await.unwrap();
     assert_eq!(log[0].kind(), walgit_proto::v1::EntryKind::Settings);
     assert_eq!(log[0].settings.as_ref().unwrap().author, "alice");
@@ -2231,25 +2260,95 @@ async fn test_repo_settings_publish_and_effective_config() {
     let h2 = registry2.open(&id).await.unwrap();
     h2.sync_refs().await.unwrap();
     assert_eq!(h2.settings().unwrap().revision, 1);
-    assert_eq!(h2.effective_config().bundles.min_commits, 3);
+    assert_eq!(h2.effective_config().packs.geometric_factor, 3);
 
     // Second publish bumps the revision; clearing restores the host config.
     assert_eq!(
         handle
-            .publish_settings("[bundles]\nmin_commits = 9\n", "alice", "")
+            .publish_settings("[packs]\ngeometric_factor = 9\n", "alice", "")
             .await
             .unwrap(),
         2
     );
-    assert_eq!(handle.effective_config().bundles.min_commits, 9);
+    assert_eq!(handle.effective_config().packs.geometric_factor, 9);
     assert_eq!(
         handle.publish_settings("", "alice", "clear").await.unwrap(),
         3
     );
     assert_eq!(
-        handle.effective_config().bundles.min_commits,
-        make_config(cache.path(), 0).bundles.min_commits
+        handle.effective_config().packs.geometric_factor,
+        make_config(cache.path(), 0).packs.geometric_factor
+    );
+}
+
+/// Old bucket settings keep their supported overrides and original audit record.
+#[tokio::test]
+async fn test_repo_settings_bundle_removal_replays_without_losing_overrides() {
+    use prost::Message;
+    use walgit_store::ObjectStoreExt;
+    let cache = tempfile::tempdir().unwrap();
+    let store = MemoryStore::shared();
+    let registry = Registry::new(store.clone(), Arc::new(make_config(cache.path(), 0)));
+    let id = repo_id("test", "saved-settings");
+    let handle = registry.create(&id, ObjectFormat::Sha1).await.unwrap();
+    let supported = "[packs]\ngeometric_factor = 3\n[upstream]\ngit = \"https://git.example.com/acme/source.git\"\nfollow = [\"refs/heads/release\"]\n";
+    handle
+        .publish_settings(supported, "alice", "preserve scope")
+        .await
+        .unwrap();
+    let saved = format!(
+        "# Historical configuration\n[bundles]\nenabled = false\n{}",
+        supported.replace("[packs]\ngeometric_factor", "[compaction]\nfactor")
+    );
+
+    // Encode the manifest and log as an older writer did. New writes cannot
+    // introduce this document, so seed persisted bytes rather than a shim API.
+    let mkey = format!("{}{}", id.store_prefix(), walgit_proto::keys::MANIFEST);
+    let (_, bytes) = store.get_bytes(&mkey).await.unwrap().unwrap();
+    let mut manifest = walgit_proto::v1::Manifest::decode(bytes.as_ref()).unwrap();
+    manifest.settings.as_mut().unwrap().toml = saved.clone();
+    let segment = &mut manifest.log_segments[0];
+    let lkey = format!("{}{}", id.store_prefix(), segment.key);
+    let (_, bytes) = store.get_bytes(&lkey).await.unwrap().unwrap();
+    let (mut entries, _) = walgit_proto::frame::decode_entries(&bytes).unwrap();
+    entries[0].settings.as_mut().unwrap().toml = saved.clone();
+    let log_bytes = walgit_proto::frame::encode_entries(entries.iter());
+    segment.size = log_bytes.len() as u64;
+    store
+        .put_bytes(&lkey, log_bytes, walgit_store::PutMode::Overwrite)
+        .await
+        .unwrap();
+    store
+        .put_bytes(
+            &mkey,
+            manifest.encode_to_vec(),
+            walgit_store::PutMode::Overwrite,
+        )
+        .await
+        .unwrap();
+
+    let cache2 = tempfile::tempdir().unwrap();
+    let reader = Registry::new(store.clone(), Arc::new(make_config(cache2.path(), 0)));
+    let replayed = reader.open(&id).await.unwrap();
+    replayed.sync_refs().await.unwrap();
+    let effective = replayed.effective_config();
+    assert_eq!(effective.packs.geometric_factor, 3);
+    assert_eq!(
+        effective.upstream.git.as_deref(),
+        Some("https://git.example.com/acme/source.git")
+    );
+    assert_eq!(effective.upstream.follow, ["refs/heads/release"]);
+    assert_eq!(replayed.settings().unwrap().toml, saved);
+    let log = replayed.read_log(1, None).await.unwrap();
+    assert_eq!(log[0].settings.as_ref().unwrap().toml, saved);
+    assert!(
+        replayed
+            .publish_settings(&saved, "bob", "new write")
+            .await
+            .is_err()
     );
+    assert_eq!(replayed.settings().unwrap().revision, 1);
+    assert_eq!(replayed.manifest().head_seq, 1);
 }
 
 /// D22 provenance on the checkpoint: `first_state_at` = the earliest entry
@@ -2650,3 +2749,242 @@ async fn a_landed_cas_is_ok_even_when_the_local_apply_fails_and_the_next_sync_re
     );
     assert_eq!(handle.applied_seq(), 2);
 }
+
+#[tokio::test]
+async fn noop_receipts_never_claim_a_siblings_log_entry() {
+    let cache = tempfile::tempdir().unwrap();
+    let store = MemoryStore::shared();
+    let registry = Registry::new(store, Arc::new(make_config(cache.path(), 20)));
+    let handle = registry
+        .create(&repo_id("o", "noop"), ObjectFormat::Sha1)
+        .await
+        .unwrap();
+    let work = WorkRepo::new();
+    let tip = work.commit("first", "content");
+    let pack = ingest_pack_data(&handle, work.create_pack()).await.unwrap();
+    // Empty-ref pack publication is not a back door into the durable inventory.
+    let error = handle
+        .publish_push(Some(pack), make_txn(vec![]), HashMap::new())
+        .await;
+    assert!(matches!(error, Err(walgit_wal::WalError::Invalid(_))));
+    assert_eq!(handle.manifest().head_seq, 0);
+    assert!(handle.manifest().packs.is_empty());
+    let pack = ingest_pack_data(&handle, work.create_pack()).await.unwrap();
+    handle
+        .publish_push(
+            Some(pack),
+            make_txn(vec![("refs/heads/main", "", &tip)]),
+            HashMap::new(),
+        )
+        .await
+        .unwrap();
+    let unchanged = make_txn(vec![("refs/heads/main", &tip, &tip)]);
+    for _ in 0..2 {
+        let receipt = handle
+            .publish_push(None, unchanged.clone(), HashMap::new())
+            .await
+            .unwrap();
+        assert_eq!(receipt.seq, 0);
+        assert!(receipt.per_ref.iter().all(|(_, status)| status.is_ok()));
+        assert_eq!(handle.manifest().head_seq, 1);
+    }
+    let (noop, changed) = tokio::join!(
+        handle.publish_push(None, unchanged.clone(), HashMap::new()),
+        handle.publish_push(
+            None,
+            make_txn(vec![("refs/heads/other", "", &tip)]),
+            HashMap::new()
+        ),
+    );
+    assert_eq!(noop.unwrap().seq, 0);
+    assert_eq!(changed.unwrap().seq, 2);
+    let (noop, rejected) = tokio::join!(
+        handle.publish_push(None, unchanged, HashMap::new()),
+        handle.publish_push(
+            None,
+            make_txn(vec![("refs/heads/main", "", &tip)]),
+            HashMap::new()
+        ),
+    );
+    assert_eq!(noop.unwrap().seq, 0);
+    let rejected = rejected.unwrap();
+    assert_eq!(rejected.seq, 0);
+    assert!(rejected.per_ref.iter().all(|(_, status)| status.is_err()));
+    assert_eq!(handle.manifest().head_seq, 2);
+    assert_eq!(handle.read_log(1, None).await.unwrap().len(), 2);
+    let refused = handle
+        .publish_push(
+            None,
+            make_txn(vec![
+                ("refs/heads/partial", "", &tip),
+                ("refs/heads/main", "", &tip),
+            ]),
+            HashMap::new(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(refused.seq, 0);
+    assert!(refused.per_ref.iter().all(|(_, status)| status.is_err()));
+    assert!(
+        handle
+            .local()
+            .ref_view()
+            .unwrap()
+            .get("refs/heads/partial")
+            .is_none()
+    );
+    let multi = handle
+        .publish_push(
+            None,
+            make_txn(vec![
+                ("refs/heads/left", "", &tip),
+                ("refs/heads/right", "", &tip),
+            ]),
+            HashMap::new(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(multi.seq, 3);
+    assert_eq!(multi.per_ref.len(), 2);
+    assert!(multi.per_ref.iter().all(|(_, status)| status.is_ok()));
+}
+
+#[tokio::test]
+async fn lost_cas_reply_is_resolved_or_unknown_without_losing_the_commit() {
+    use walgit_store::fault::{FaultPlan, FaultStore};
+    let cache = tempfile::tempdir().unwrap();
+    let truth = MemoryStore::shared();
+    let link = FaultStore::new(truth, "lost-reply", 1);
+    let registry = Registry::new(link.clone(), Arc::new(make_config(cache.path(), 0)));
+    let handle = registry
+        .create(&repo_id("o", "unknown"), ObjectFormat::Sha1)
+        .await
+        .unwrap();
+    let work = WorkRepo::new();
+    let tip = work.commit("first", "content");
+    let pack = ingest_pack_data(&handle, work.create_pack()).await.unwrap();
+    handle
+        .publish_push(
+            Some(pack),
+            make_txn(vec![("refs/heads/main", "", &tip)]),
+            HashMap::new(),
+        )
+        .await
+        .unwrap();
+    for (name, hide_evidence) in [("resolved", false), ("unknown", true)] {
+        link.set(FaultPlan {
+            p_err_after: 1.0,
+            only_keys: Some(vec!["manifest.pb".into()]),
+            deny_keys: if hide_evidence {
+                vec!["manifest.pb".into()]
+            } else {
+                vec![]
+            },
+            ..Default::default()
+        });
+        let reference = format!("refs/heads/{name}");
+        let result = handle
+            .publish_push_synced(None, make_txn(vec![(&reference, "", &tip)]), HashMap::new())
+            .await;
+        if hide_evidence {
+            assert!(matches!(
+                result,
+                Err(walgit_wal::WalError::CommitUnknown(_))
+            ));
+        } else {
+            assert!(
+                result
+                    .unwrap()
+                    .per_ref
+                    .iter()
+                    .all(|(_, status)| status.is_ok())
+            );
+        }
+        link.heal();
+        drop(handle.sync_refs().await.unwrap());
+        assert_eq!(
+            handle.local().ref_view().unwrap().get(&reference),
+            Some(tip.clone())
+        );
+    }
+    assert_eq!(handle.read_log(1, None).await.unwrap().len(), 3);
+}
+
+#[tokio::test]
+async fn readiness_carries_only_proven_inventory_and_rechecks_revision_only_restart() {
+    let writer_cache = tempfile::tempdir().unwrap();
+    let reader_cache = tempfile::tempdir().unwrap();
+    let store = MemoryStore::shared();
+    let writer_registry =
+        Registry::new(store.clone(), Arc::new(make_config(writer_cache.path(), 0)));
+    let id = repo_id("o", "readiness");
+    let writer = writer_registry
+        .create(&id, ObjectFormat::Sha1)
+        .await
+        .unwrap();
+    assert!(
+        writer.packs_ready(),
+        "new empty inventory is proven at its birth revision"
+    );
+    let work = WorkRepo::new();
+    let tip = work.commit("first", "content");
+    let pack = ingest_pack_data(&writer, work.create_pack()).await.unwrap();
+    let checksum = pack.checksum;
+    writer
+        .publish_push(
+            Some(pack),
+            make_txn(vec![("refs/heads/main", "", &tip)]),
+            HashMap::new(),
+        )
+        .await
+        .unwrap();
+    assert!(writer.packs_ready());
+    let reader_registry =
+        Registry::new(store.clone(), Arc::new(make_config(reader_cache.path(), 0)));
+    let reader = reader_registry.open(&id).await.unwrap();
+    assert!(!reader.packs_ready());
+    drop(reader.sync().await.unwrap());
+    assert!(reader.packs_ready());
+    writer
+        .publish_settings("[packs]\nenabled = false\n", "test", "unchanged inventory")
+        .await
+        .unwrap();
+    assert!(
+        writer.packs_ready(),
+        "settings must not invent installation work"
+    );
+    drop(reader.sync_refs().await.unwrap());
+    assert!(
+        reader.packs_ready(),
+        "refs apply carries only an identical proven inventory"
+    );
+    drop(reader);
+    drop(reader_registry);
+    let seq = writer.manifest().head_seq;
+    let rev = writer.local().write_rev_index(&checksum).await.unwrap();
+    writer
+        .annotate_pack(&checksum.to_string(), Some(rev), None, None)
+        .await
+        .unwrap();
+    assert_eq!(
+        writer.manifest().head_seq,
+        seq,
+        "annotation changes revision without log sequence"
+    );
+    let reopened_registry = Registry::new(store, Arc::new(make_config(reader_cache.path(), 0)));
+    let reopened = reopened_registry.open(&id).await.unwrap();
+    assert!(
+        !reopened.packs_ready(),
+        "saved counters must not hide a new side file"
+    );
+    let local_rev = reopened.local().pack_path(&checksum).with_extension("rev");
+    assert!(!local_rev.exists());
+    drop(reopened.sync().await.unwrap());
+    assert!(reopened.packs_ready());
+    assert!(local_rev.is_file());
+    drop(reopened.sync().await.unwrap());
+    assert!(
+        reopened.packs_ready(),
+        "reconciliation must settle at the held revision"
+    );
+}
diff --git a/deploy/nginx.conf.example b/deploy/nginx.conf.example
index e314c46..14d57ba 100644
--- a/deploy/nginx.conf.example
+++ b/deploy/nginx.conf.example
@@ -4,15 +4,15 @@
 # byte and authenticates every request. Put nginx in front when you want one of:
 #
 #   1. Public TLS with your own certificates / ACME client, HTTP/2 + HTTP/3, rate limits.
-#   2. **Byte offload with a disk cache (`X-Accel-Redirect`)**: clone bundles and LFS
+#   2. **Byte offload with a disk cache (`X-Accel-Redirect`)**: immutable packs and LFS
 #      objects are big, immutable and content-addressed. With this config walgit still
 #      does auth, existence, validators and 304s, but answers the *bytes* with an
 #      internal redirect; nginx fetches the object from the bucket itself (S3 or GCS),
-#      slices ranges, and keeps it on local disk. A 30 GB weekly bundle then costs the
+#      slices ranges, and keeps it on local disk. A large immutable object then costs the
 #      walgit process nothing per download, and the second download is served from the
 #      edge's disk.
 #   3. One `auth_request` verdict per credential cached for a few minutes, so a clone
-#      that opens many connections (every bundle is its own `git-remote-https`) does not
+#      that opens many connections (each static download uses `git-remote-https`) does not
 #      verify the same token many times.
 #   4. Routing several repositories to several walgit hosts by the repository prefix
 #      (`/<owner>/<repo>` is the only routing key walgit needs; nothing else).
@@ -49,7 +49,7 @@ http {
     # ---- walgit upstream(s) -------------------------------------------------------
     # One box: one upstream. Several boxes: keep one upstream per group of repositories
     # and route with `location ~ ^/acme/monorepo([./?]|$)` blocks below (the repo prefix
-    # is the routing key; `.git`, `/api`, bundles and LFS all live under it).
+    # is the routing key; `.git`, `/api`, packs and LFS all live under it).
     upstream walgit {
         server 127.0.0.1:8080;          # walgit serve, server.tls.mode = "off" (h2c)
         keepalive 64;
@@ -141,7 +141,7 @@ http {
             proxy_set_header Connection "";
         }
 
-        # ---- everything else: repositories, API, UI, git, bundles, LFS -------------------
+        # ---- everything else: repositories, API, UI, git, packs, LFS -------------------
         location / {
             auth_request /_auth/check;
             error_page 401 = @need_signin;
diff --git a/docs/BUNDLE_URI_DESIGN.md b/docs/BUNDLE_URI_DESIGN.md
deleted file mode 100644
index 9b0a570..0000000
--- a/docs/BUNDLE_URI_DESIGN.md
+++ /dev/null
@@ -1,368 +0,0 @@
-# bundle-uri design — how walgit moves clone bytes to static files
-
-Context: **design of record for bundle-uri** — the north star of `GOAL.md` (fast clone + fast catch-up through
-static bundles). For the agent/human building or reviewing the bundle scheduler, the SSD maintainer's weekly
-base rebuild, or the
-clone/fetch experience of big repos. Normative where marked; `AGENTS.md §2.6` is the summary, D17/D21/D22 the
-decisions. Technical detail for `crates/walgit-bundle`, SSD-backed maintainers, and manual
-`walgit compact --base` recovery.
-
-Status: **implemented design of record** (2026-08-21). Calendar slots, deterministic tokens, as-of-slot
-content, backfill, two-newest retention, self-contained incrementals, and the blobless family are live.
-Remaining work belongs in §8 and `AGENTS.md §6`. Reading order:
-AGENTS.md §2.6 (summary) → this file (detail) → `crates/walgit-bundle/` (code) → `web/API.md` (what the UI shows).
-
-## 1. Why bundles exist here
-
-A small instance is 8 vCPU / 32 GiB with a memory-backed disk; `acme/monorepo`'s base pack alone is 32 GB.
-The instance must never hold or stream that pack. So **the first fetch of history is never answered by
-upload-pack**: the application hands the client URLs of static bundle files, which the edge serves from GCS or
-its immutable-object cache without streaming bytes through an application worker. The client applies them and
-only then asks upload-pack for the delta between the newest bundle and now. Static files are cacheable,
-Range-capable, and CDN-able. This is the same mechanism git uses for `clone --bundle-uri`; we only decide
-*what* to cut, *when*, and
-*how the chain fits together*.
-
-Everything below is about making that delta small **for the client that matters**: someone on `main` (or a
-branch a few commits off main) who cloned days ago.
-
-## 2. Git's side: what a bundle is and how `creationToken` behaves
-
-A git bundle file = header + packfile.
-- Header lists the **refs it contains** (`<sha> refs/heads/main`, `HEAD`) and **prerequisites** (`-<sha>`):
-  commits the receiver must already have. A *full* bundle has no prerequisites; an *incremental* one says
-  "given you have X, here are the objects from X to the tips".
-- The server's **bundle list** (`bundles/list`, also the v2 `bundle-uri` command) is git-config text:
-  ```
-  [bundle]
-      version = 1
-      mode = all
-      heuristic = creationToken
-  [bundle "weekly-1787... "]
-      uri = https://git.example.com/acme/monorepo/bundles/weekly/<file>.bundle
-      creationToken = 1787211600
-  ```
-- `heuristic = creationToken` algorithm (git ≥ 2.38, what `transfer.bundleURI=true` / `fetch.bundleURI` run):
-  1. Sort entries by token **descending**. Download the newest; if its prerequisites are missing, download the
-     next older; repeat until one applies (or a full bundle is reached).
-  2. Apply them **oldest → newest**.
-  3. Record the highest token applied in `fetch.bundleCreationToken`.
-  4. On later `git fetch`: download only entries with token **greater** than that, apply, then negotiate the
-     rest with the server as usual (`want main, have <newest bundle tip>`).
-- Consequences we design around:
-  - Tokens must be **monotonic along the chain** and **deterministic** (a backfilled older bundle must get an
-    older token than a newer one, even if it is *built* later).
-  - Every incremental bundle's prerequisites must be exactly the tips of the bundle below it in the chain, or
-    git walks further down (more downloads) — a broken link degrades to "download more", never to "wrong".
-  - Git only downloads what it needs: cumulative daily/hourly bundles let a stale client stop at the newest
-    applicable bundle whose prerequisites it already has, then fetch roughly the unbundled remainder.
-
-## 3. What we cut — decisions
-
-| Decision | Choice | Why |
-|---|---|---|
-| **Refs** | For `bundles.require`/big repos: `HEAD` + `refs/heads/main` only (`bundles.main_only`, override per strategy with `refs = [...]`, e.g. add `refs/tags/v*`). Small repos: `refs/heads/*`, `refs/tags/*`, `HEAD` (today's default). | Almost every client wants main + one branch. Branches are tiny per-fetch deltas *on top of* main (`want branch, have main@bundle`); after a rebase the branch's commits sit on newer main that the hourlies already delivered — rebased branches get **cheaper**, not slower. Putting 466 k refs or all branches in bundles would bloat every incremental and help nobody. |
-| **Weekly (full)** | One per calendar week, **Sunday 23:00 UTC** slot. For a big repository: a **compose** of the tier-2 base pack + a generated header (GCS `compose` natively, S3 by multipart `UploadPartCopy`; no bytes through walgit, ~2 s for 32 GB on GCS). Token = slot epoch. | Full history once a week; composing from the base means the weekly costs nothing to build and is identical in content to what every instance already serves from. The base rebuild (VM job) happens *with* the weekly cut, never in between, so everything newer than the base is small packs that fit every instance (AGENTS §2.5 invariant). |
-| **Daily (incremental)** | One per day, **23:00 UTC** slot; prerequisite = tips of the latest weekly ≤ slot; content = objects from that weekly's main tip to **main as of the slot time**. | Nightly is when CI is quiet and when "how stale is my clone" is measured in days. |
-| **Hourly (incremental)** | One per hour, **:00** slot; prerequisite = tips of the latest daily ≤ slot; content = main from that daily to main as of the slot. | Keeps the server-side remainder to < 1 h of pushes. |
-| **Content "as of the slot"** | The WAL is timestamped and sequenced: resolve the **highest seq with `created_at` ≤ slot time**; replay refs to that seq (refs-level, the `wal materialize --at-seq` machinery); cut tips from that state. | Makes **backfill correct**: a "Tuesday" bundle built on Thursday contains Tuesday's main, so the chain's prerequisites line up and tokens stay truthful. |
-| **Token** | `creationToken = slot epoch seconds` (weekly: Sunday 23:00; daily: 23:00; hourly: :00). | Deterministic, monotonic, independent of when the maintainer happened to run. |
-| **Retention** | `keep` newest weeklies (2); **dailies are chained** (`chain = true`, the operator 2026-08-22): every daily since the newest kept weekly, each cut on the previous daily (≤ 7); hourlies on the newest daily, the **2 newest** kept (D21 amended 2026-08-22). Never an orphan. The maintainer applies it every pass, not only on publish. | git downloads *every* listed bundle newer than the newest full on a clone, newest-first, until one whose prerequisites it has (43 downloads / 11.5 s on a 1 MB repo under the old unbounded rule). Chained dailies carry exactly their day: a fresh clone is 1 weekly + ≤ 7 dailies + 2 hourlies, a days-stale catch-up is exactly the days missed + ≤ 2 hourlies, no overlapping bytes (local rig: stale at daily #2 → dailies #4, #3 + 145 B upload-pack). Unchained hourlies keep an hourly catch-up at ≤ 2; the second one keeps a client that read the list a slot ago from a 404 (git never retries a bundle download). A `chain = true` strategy wants at most one base period of slots (`slots::chain_window`). |
-| **Naming / storage** | `bundles/<strategy>/<slotUTC>-<sha1 of content>.bundle` (immutable, content-addressed, ETag = checksum), list at `bundles/list.pb` (CAS). Keys never overwritten. | Immutable → `Cache-Control: immutable`, Range, CDN; CAS'd list = atomic publish. |
-| **Serving** | `serve_via = proxy` (streamed from the bucket through a serving host with the full static contract: ETag/304/If-Range/Range/HEAD) or `signed_url` (direct object-store URL). Signing may be unavailable or denied by the store; failure falls back to proxy per entry and never fails the listing. | Static contract either way; direct URLs remove the serving process from the byte path when the store permits signing. |
-| **Two lists: clone and catch-up** (2026-08-22) | `bundles/list` is the clone list (fulls + chain); **`bundles/catchup`** is the same list **without the fulls**, and it is what every recipe records in `fetch.bundleURI`. Dailies chain *through* the weekly: Sunday's daily and the weekly fire at the same instant and have the same tips, so Monday's daily is cut on Sunday's daily (tie → own chain, `slots::base_for_incremental`), and retention keeps the chain under every kept full (`keep = 2` on the weekly = two weeks of catch-up through bundles). | git's creationToken walk goes newest-first and a full has no prerequisites, so a fetching client downloads **every full newer than its token** — the new weekly, 32 GB from a large repository, on the first fetch after Sunday (measured on the rig: round 1 of `rig/catchup`). A client with history never needs a full; with no fulls in its list and a chain that crosses the week, it walks daily → daily to a link whose prerequisites it has. Fresh clones still take the newest weekly (they have its objects, so Monday's prerequisites hold). e2e `fetch_after_the_recipe_clone_uses_the_bundles` covers the rollover. |
-| **Advertising** | v2 capability `bundle-uri` + the `bundle-uri` command; static list at `/{o}/{r}.git/bundles/list`; `/services/public/install.sh` sets `transfer.bundleURI=true` + `fetch.bundleURI`. The narrated fetch echoes each advertised bundle: `* bundle-uri: /acme/monorepo/bundles/weekly/<file> (32.3 GB, full, seq 1, token …)`. | Users see where bytes come from. |
-| **Forcing** | `bundles.require = ["acme/monorepo"]` (D17): an **unbounded zero-have** fetch (a full clone that skipped bundles) is refused with the exact fix; `--depth`/`--filter` zero-have fetches (CI) and all fetches with haves proceed. **One-shot fallback** (2026-08-21): a principal that fetched `bundles/list` within the hour *tried* bundle-uri — git does not retry a failed bundle download and then sends exactly this zero-have fetch — so it gets one upload-pack clone per 6 h with a loud band-2 warning; the next one and anyone who never tried are refused, truthfully. | Protects the instances from the one request they cannot serve; keeps CI's shallow/partial clones (the 2075 s benchmark shape) on upload-pack, where they take ~8 s. The fallback trades ≈ 32 GB of egress + minutes of the SSD host (deltas reused from the base: pack-objects is I/O-bound, not CPU-bound) for "`git clone` never fails"; the rate limit keeps a fleet of misconfigured clients from turning the SSD host into a 32 GB-per-clone server — the same request without the list fetch first is still refused. |
-
-## 4. Scheduling: calendar slots with backfill
-
-Each maintainer derives the slot plan from repository settings and WAL state on every pass:
-
-```
-for each strategy (weekly → daily → hourly, so bases exist first):
-    slots = all slot times from the base's previous slot .. now
-    wanted = fulls: every slot; incrementals: the 2 newest slots (older content is subsumed by the newer)
-    missing = wanted slots with no bundle in the list
-    build missing oldest-first (≤ backfill_max per pass; 1 for weekly)
-    each build: seq = highest WAL seq with created_at ≤ slot
-                tips = ref state at seq filtered by strategy refs
-                prereqs = tips of the newest bundle of `base` with slot ≤ this slot
-                token = slot epoch; key = bundles/<strategy>/<slot>-<sha>.bundle
-    publish list (CAS) after each bundle, retention applied; retention also applied at the start of every pass
-```
-Runs on the repository's assigned maintainer (`roles=["serve","maintain"]`) every pass: the SSD host owns
-`acme/monorepo`; the push broker owns the remaining assigned repositories. The first pass after downtime fills
-the holes. `walgit bundle plan <repo>` prints the slot table and the WAL page shows it.
-
-**Config standard** (`walgit.example.toml` is normative; `walgit config check` enforces it):
-
-```toml
-[bundles]
-main_only  = true                 # default refs: HEAD + refs/heads/main (false: heads/* + tags/* + HEAD)
-extra_refs = []                   # globs added to every bundle's default ref set, e.g. ["refs/tags/v*"]
-require    = ["acme/monorepo"]       # D17: unbounded zero-have fetches refused with the fix text
-[[bundles.strategy]]
-name = "weekly"; kind = "full";        schedule = "0 0 23 * * Sun"; keep = 2; backfill_max = 1
-[[bundles.strategy]]
-name = "daily";  kind = "incremental"; base = "weekly"; schedule = "0 0 23 * * *"; backfill_max = 0
-[[bundles.strategy]]
-name = "hourly"; kind = "incremental"; base = "daily";  schedule = "0 0 * * * *";  backfill_max = 48
-```
-- `schedule`: 6-field cron, **UTC** (`@weekly/@daily/@hourly` = the defaults above). Each fire time is a
-  **slot** = the as-of instant of the content; `creationToken` = slot epoch seconds.
-- `kind = "full"` has no prerequisites; `incremental` needs `base` (prereqs = tips of the newest **base** bundle
-  with slot ≤ this slot — a daily is built on the latest *weekly*, an hourly on the latest *daily*, never on the
-  previous bundle of its own kind). So a client applies weekly + ≤ 1 daily + ≤ 1 hourly; intermediate bundles are
-  independent of each other (a missing Tuesday daily does not affect Wednesday's). The price: a Saturday daily
-  carries six days of objects, the 22:00 hourly carries 22 hours — still small next to the weekly. A new weekly
-  restarts the daily chain; the latest daily the hourly chain.
-  **Base resolution goes up the chain**: when no bundle of the base strategy exists at/before the slot (a
-  repository's first day: weekly cut Sunday, first daily Monday 23:00), the incremental is cut on the nearest
-  ancestor that has one — Monday's hourlies on the weekly (prerequisites = its tips, satisfiable by any client that
-  has the weekly) — never blocked, and never "the base cut at this slot" (the old fallback would have produced a daily
-  with an hourly's slot/token).
-- `keep` = weeklies listed (fulls only). Incrementals have no knob: always the 2 newest whose base is kept
-  (`INCREMENTALS_KEPT`); setting `keep` on one fails `Config::validate`.
-- `backfill_max` = missing slots built per pass (0 = unlimited), oldest first — for incrementals at most the 2 newest
-  slots are ever missing.
-- **Selection order** (D22): every pass, per assigned repo, the single most important missing unit (a bundle slot that turns out to have nothing to cut — too small, no state as of the slot — is re-planned at once, up to 48 per pass, so stale slots never delay the current hour) — checkpoint-if-due
-  → repair (objects the last fsck found missing, from `upstream.git`) → missing weekly → missing dailies (oldest first)
-  → missing hourlies (oldest first) → compaction → fsck audit (`maintenance.fsck_interval`; `docs/INTEGRITY.md`).
-  **Placement**: `[placement] maintain/maintain_exclude` (D30) + declared capacity; acme/monorepo is assigned to the big host only —
-  on any other instance its units are `wrong-host`, never attempted.
-- **Minimum-size gate**: `bundles.min_commits` (default 25; per-strategy override; `min_bytes` optional): an
-  incremental slot with fewer commits since its base is plan state `too-small` and is not built — the next slot of
-  the same strategy is built on the same base, so nothing is lost. Fulls are never gated. Measured by
-  `git rev-list --count <tips> --not <base tips>` over the local commit-graph (commits/trees are local on every
-  host), after the lease and before any pack work; the measurement is this maintainer's (in-memory) view, so
-  `walgit bundle plan` / the WAL page show `too-small` on the host that measured it and `missing` elsewhere.
-  **The verdict on a closed slot is final** (given its base bundle): it is recorded in `bundles/list.pb`
-  (`BundleList.skipped {strategy, slot, base_id, as_of_seq, reason}`) and planned as `skipped` by every host and across
-  restarts in O(1) — no re-measuring (a restart re-walked ~30 closed slots before reaching the live hour, 2026-08-21).
-  A slot is **closed** once its as-of instant is 120 s in the past (entries are stamped at publish time, monotonic).
-- **Unchanged gate**: an incremental whose tip set (name + oid) equals the newest built incremental of the same
-  strategy on the same base is `skipped (unchanged since <id>)` — recorded like too-small. `min_commits` counts since
-  the *base*, so without this an idle night cut 23–48 byte-identical 315 MB hourlies a day on the monorepo (2026-08-21
-  08:00/09:00/10:00). Clients are unaffected: git stops at the first bundle whose prerequisites it has.
-  A new base bundle for the slot re-opens it; the open (current) slot is never recorded. `min_bytes` is parsed, not yet enforced. The same gate for checkpoints is the existing trigger set
-  (`wal.snapshot_every_entries` = the entry floor, `checkpoint_interval` = the age override, `checkpoint_tail_bytes`);
-  compaction's byte/count triggers likewise.
-- **D21 — no monthly layer**: git's heuristic never walks past a full bundle, and it downloads everything listed
-  above it, so the list *is* the clone cost: with two-newest retention a fresh clone is newest weekly + ≤ 2 dailies +
-  ≤ 2 hourlies = 5 downloads regardless of history length.
-
-### 4b. Self-healing (D22)
-The slot plan is recomputed every pass from config + WAL; the maintainer performs one bounded unit of the most
-important missing work (weekly → dailies oldest-first → hourlies). Missing, deleted, or corrupt bundles are simply
-"missing" and are rebuilt identically (content and token are functions of the slot and the WAL state as of it).
-Slots with no WAL state at/before them are *unavailable* (plan shows it). No one-off backfill scripts exist;
-replaying older history into the WAL (explicit `created_at`) makes the same loop fill the older slots.
-
-## 5. Building: where the bytes come from
-
-- **Full (weekly) for a repo whose pack set fits** an instance: `git bundle create` / gix from the local copy.
-- **Full for a big repository — the Sunday unit**: the maintainer's missing weekly slot on an ssd host
-  (the SSD host) first yields `Unit::BaseRebuild` when the newest tier-2 base predates the week (`base.seq ≤ seq as of
-  max(previous weekly slot, first state)` — pushes landing *during* the rebuild do not re-trigger it; next Sunday does):
-  the `compact base=1` op = `git repack -adb` (bitmap) + D18 history pack + commit-graph layer, published as a tier-2
-  COMPACT entry superseding every smaller pack. The weekly slot itself then **composes** header (refs at the base's
-  seq — a checkpoint written on the spot when none exists and no ref moved since) ∘ base pack via GCS compose
-  (`walgit_server::bundles::compose_full_from_base`, also the CLI's `walgit bundle compose`): zero bytes through the
-  host, no index-pack. A Full slot of a repository with a base is never a `pack-objects` of its history. tmpfs hosts
-  never rebuild (they compose the base they have). Test: `weekly_slot_rebuilds_the_base_then_composes_it_on_an_ssd_maintainer`.
-- **Incremental**: on a host with the packs local (the SSD host), our own header + `git pack-objects --revs
-  --delta-base-offset` — **self-contained deltas, never `--thin`** (`git bundle create` always packs thin: deltas
-  against the prerequisites' objects, which the client must resolve against its 32 GB base). Measured on the monorepo's
-  07:00 hourly, same object set (2026-08-21): thin 226.8 MB, client `index-pack` 48.4 s and 420 MB on disk (193 MB
-  of bases appended by `--fix-thin`); self-contained **314.9 MB (+39 %), 31.7 s (−35 %), 315 MB on disk**; server
-  pack-objects 8.9 → 19.7 s. Static bytes are the cheap resource. The **gix engine** (`write_bundle_gix`) remains
-  for a host whose base is linked/remote: tree-diff enumeration over the commit-graph + history pack, delta bases
-  faulted through the remote reader.
-- Every build is a **task** (discoverable at `…/tasks`, narrated); the builder materializes what it needs
-  first (`BundleSource::prepare_objects`, the "bad object" fix) and skips refs whose tips it cannot resolve with
-  a notice rather than failing the repo.
-- Checksum streamed (bundles are GBs); upload `Create` (immutable); list updated by CAS; old entries pruned per
-  retention with the list generation respected.
-
-### 5a. Resumable `BaseRebuild` (2026-08-22, landed: `crates/walgit-server/src/rebuild.rs`)
-
-Context: D31 drains interrupt the running unit at once and let D22 redo it — fine for an hourly bundle, wrong for
-the monorepo's base: `git repack -adb` is 16–30 min of one core plus the 10-min history pack, and a deploy (every few hours
-today) threw it away and restarted it on the next pass — and the repack rewrote the *serving copy* in place. The
-shape below is what runs now for the weekly `BaseRebuild` unit and for `walgit compact --base` alike:
-
-1. **Scratch dir that outlives the container**: the rebuild runs in `<cache.dir>/_rebuild/<owner>/<repo>.git/` on
-   `/data` (bind mount, survives `docker run` restarts; `cp -a --reflink=always` of the serving copy on XFS = seconds,
-   no bytes copied until written), never in the serving copy — the serving copy keeps answering fetches from its
-   unchanged pack set meanwhile (today the repack rewrites the serving copy's `objects/pack` in place).
-2. **Phase marker** `_rebuild/<o>/<r>.json`: `{ started_head_seq, base_checksum?, phase }` with phases
-   `repacked → side-files (rev/bitmap/commit-graph) → history-pack → uploaded → published`, written after each phase
-   completes (the pack files themselves are the evidence; the marker only says which ones are final).
-3. **Resume rule**: the next `BaseRebuild` unit (any pass after the restart, same host — the scratch dir is the host's)
-   reads the marker; **iff `manifest.head_seq == started_head_seq`** it continues from the recorded phase, otherwise it
-   deletes the scratch dir and starts over (a push landed: the pack would miss objects; AGENTS §2.5 "pushes landing
-   during the rebuild do not re-trigger it" stays true because the *planner* still uses the slot rule — only the resume
-   check is strict). Partial uploads are immutable `Create`s keyed by checksum: re-running them is a no-op/412-as-exists.
-4. **Idempotent publish**: `publish_compact` of a pack already live under the same checksum is skipped (landed 2026-08-22
-   in `compact_repo`); a COMPACT entry that supersedes packs already superseded is harmless (`supersedes` of absent
-   packs is ignored by readers — to verify with a sim scenario).
-5. **Not awaited on drain** (D31 phase 1 unchanged): SIGTERM kills `git repack`; the marker's phase is whatever
-   completed; `git` writes packs via a temp name + rename, so a half-written pack never looks complete.
-6. Tests: sim `base_rebuild_resumes_after_a_kill_between_any_two_phases` — the unit is killed after *each* phase in
-   turn (per-repo test hook `rebuild::TEST_ABORT_AFTER`, standing in for SIGTERM), the instance restarts on the same
-   disk, and across all attempts there is exactly **one** `git repack`; the serving copy's pack files are unchanged
-   until publish; a push between a kill and the resume forces a fresh start whose base contains the pushed tip.
-   Budget: unchanged store round trips on the happy path (the marker is local). Also: the publisher now queues its own
-   superseded packs for removal by the next pack sync (the in-place repack used to delete them; the scratch one
-   leaves them in the serving copy until readers are gone). Headroom check: the rebuild refuses to start with less
-   free space under `cache.dir` than the live pack set (the new pack is about that size). Out of scope: imports
-   (`walgit import` resumability is a different shape — staged upload of many packs), and a tmpfs host (tmpfs dies with
-   the instance; bases are never rebuilt there).
-
-## 6. What a client experiences
-
-| Client state | What git does | Server work |
-|---|---|---|
-| Fresh `clone` (bundle-uri on) | weekly (32 GB from bucket) + dailies + hourlies newer than the weekly, then `fetch` remainder | one negotiation: ≤ 1 h of objects from local small packs |
-| Fresh `clone --depth=1 --filter=blob:none --single-branch` (CI) | **git still downloads the advertised bundles first** (measured 2026-08-21: the 32 GB weekly, 154 s / 4.4 GB before giving up) — the server cannot see the filter at bundle-uri time. Pass **`-c transfer.bundleURI=false`** (Clone menu + install.sh say so); then upload-pack answers directly | **8.4 s** on the large-repository benchmark (D18 result; 4.4 s / 58 MB on the SSD host 2026-08-21) — commit-graph + history pack local, blobs lazily |
-| 3 d 12:30 stale, on main | the newest applicable cumulative daily/hourly newer than its token, then fetch | ~30 min of objects |
-| 3 d stale, on a branch | same as above for main, plus `want branch` | the branch's own commits (tiny; unchanged by rebases) |
-| Very stale (older than the oldest kept weekly) | the full weekly + chain | as fresh clone |
-| bundle-uri off, full clone of the monorepo | refused (D17) with the fix text | none |
-
-## 6b. The blobless family (`filter = "blob:none"`) — developers' clones
-A developer's monorepo clone is `--filter=blob:none` with full history (CI's shape is `--depth=1 --sparse`). Git's
-bundle-uri client (2.47 … master, `bundle-uri.c`) **never consults `bundle.<id>.filter`** — the key exists only in
-`Documentation/technical/bundle-uri.adoc` — so with `transfer.bundleURI=true` a blobless clone downloads and indexes
-the full weekly: 32 GB of blobs it never asked for (measured on the local rig). Conversely a filtered bundle
-*is* unbundled (`index-pack --promisor=from-bundle`) by any clone that gets it, so a full clone fed a blobless bundle
-ends up with promisor packs it cannot complete. Hence:
-- Strategies carry `filter = "blob:none"`; a whole chain shares one filter (config validation). **Weekly-history**
-  (full, filtered) = header with `@filter=blob:none` (bundle v3) ∘ the D18 **history pack** of the base (commits +
-  trees = exactly `--filter=blob:none` of the refs at the base's seq; BaseRebuild builds it anyway) — a compose, no
-  bytes through the host. Incrementals pack with `pack-objects --filter=blob:none` (self-contained, as the full
-  family); all gates (unchanged, too-small, closed-slot verdicts) apply per strategy.
-- **Two lists, never mixed**: `bundles/list` (and the protocol v2 `bundle-uri` advertisement) carry the unfiltered
-  chain only; `bundles/list?filter=blob:none` carries the blobless family with `bundle.<id>.filter = blob:none`
-  lines. A developer (or `dev clone`) runs
-  `git clone --filter=blob:none --sparse --bundle-uri=<list>?filter=blob:none -c fetch.bundleURI=<list>?filter=blob:none …`
-  (`<list>` = `https://git.example.com/acme/monorepo.git/bundles/list`); the explicit `fetch.bundleURI` is what makes later
-  fetches use the same family — git 2.51 sets it itself only for `--bundle-uri=` clones with a creationToken list and
-  **never for an advertised (`transfer.bundleURI`) clone**, which is why every recipe we emit carries it
-  (`setup::Recipes`, 2026-08-22). Blobs arrive lazily through upload-pack as
-  today (9.2 s for a 15.9 k-file sparse add). **Always with `--sparse` (or `--no-checkout`)**: a plain checkout of
-  the monorepo's HEAD asks upload-pack for all 1.47 M blobs of the tree in one promisor fetch — one `pack-objects` on an SSD-backed
-  host at 49 GB RSS for > 12 min (2026-08-22; it exits by itself once the client disconnects, no orphan) — while the
-  sparse shape fetches blobs per `sparse-checkout add`. The Clone menu and the installer show the sparse form.
-- **Why the server cannot choose for the client**: the protocol v2 `bundle-uri` command takes no arguments at all
-  (`bundle_uri_command` in `bundle-uri.c` dies on any: "unexpected argument"), and the clone's `filter` travels only
-  in the later `fetch` command — at advertisement time walgit cannot know the clone's shape. So the protocol list
-  stays the full chain, and the **finding stands: the advertised list is actively harmful for the most common
-  developer shape** (`--filter=blob:none` + `transfer.bundleURI=true` = the full 32 GB weekly + its 19-min index-pack
-  for nothing); the Clone menu and the setup script (`/services/install.sh`) say so and give the `--bundle-uri=…?filter=blob:none` line, CI/shallow
-  clones `-c transfer.bundleURI=false`.
-- **The fix at the root** is in git: `docs/patches/0001-bundle-uri-…patch` makes the client match
-  `bundle.<id>.filter` against the clone's filter (clone passes its spec via `bundle_uri_set_filter()` because it
-  registers the promisor remote only after bundles are fetched; fetch reads `partialclonefilter`). With it
-  `bundles.advertise_filtered = true` puts both families on ONE list and each clone takes its own
-  (`tests/git-bundle-filter.sh`). Until clients carry it, the separate list URI stays.
-- Test: `blobless_bundle_family_is_composed_from_the_history_pack_and_served_on_its_own_list` (real
-  `git clone --filter=blob:none --bundle-uri` → promisor packs from the bundles, blobs missing until checkout; a full
-  clone via the protocol list sees none of it).
-
-## 6c. Client indexing cost — measured, and what to do about it (2026-08-22, design only)
-
-A full monorepo clone spends **1,063.6 s of 1,499.9 s (71 %) in the client's `index-pack`** of the 32.3 GB weekly; a
-blobless one 362.8 s over 43.6 M history objects. `git clone --bundle-uri` feeds every downloaded bundle to
-`git index-pack --fix-thin --stdin` (trace2 of a local clone confirms exactly one such child per bundle) — it never
-uses an index the server already has, although the weekly *is* `header ∘ wal/<base>.pack` and `wal/<base>.idx`/`.rev`
-sit next to it in the bucket.
-
-**Measured** on `git/git` (bundle 317.6 MB, 419,403 objects, 317,662 deltas = 76 %, 16-core laptop, git 2.51):
-| | time |
-|---|---|
-| `bundle unbundle` (= index-pack, `pack.threads` unset → online CPUs) | **5.5 s** |
-| of which *receiving* — inflate + SHA-1 of every object + trailer, **single-threaded by design** | 2.7 s ≈ 115 MB/s |
-| of which *resolving deltas* | 2.8 s on 16 threads · 4.4 s on 8 · 7.2 s on 2 · 14.9 s on 1 |
-| `core.packedGitLimit=4g core.deltaBaseCacheLimit=2g` | no effect (7.6 s, noise) |
-| `sha1sum` of the pack (what trusting a shipped index would still verify) | **0.42 s ≈ 750 MB/s** |
-| shipped index size | `.idx` 11.7 MB (3.7 %), `.rev` 1.7 MB (0.5 %) |
-Scaled to the weekly (32.3 GB, 60.1 M objects): receiving alone is ≥ 32.3 GB ÷ 115 MB/s ≈ **280 s** no matter the core
-count; the measured 1,063.6 s on the SSD host's 44 cores means resolving ≈ 780 s (deltas of large blobs; memory-bound, not
-core-bound — 44 cores did not make it 3× faster than 16 would). With a shipped index the client hashes the pack once
-(≈ 45 s at 750 MB/s, overlappable with the 100–300 MB/s download) and copies it into place: **≈ 1 min instead of
-≈ 18 min**; the clone becomes download-bound (≈ 8 min at edge-cache speed). the monorepo's `.idx` is 2.1 GB + `.rev` 240 MB:
-+7 % bytes, ≈ 10–20 s.
-
-**Options**
-- **(a) Ship `.idx`/`.rev` next to the bundle; the client skips `index-pack` when present and verified.** Server: the
-  list gains `bundle.<id>.idx` / `.rev` URIs (static objects under `/bundles/...`, for a composed weekly they *are*
-  `wal/<base>.idx`/`.rev` — zero new bytes in the bucket; for incrementals we would run `index-pack` once on the
-  maintainer, seconds). Client (a git patch, next to the `bundle.<id>.filter` patch in `docs/patches/`): in
-  `bundle-uri.c`, when the list names an index, download pack-portion + idx (+ rev) straight into `objects/pack/`
-  (the bundle's pack starts after its text header; `copy_file_range` to strip it), hash the pack and require the
-  trailer to equal the idx's embedded pack checksum and the list's `sha`, then install the header's refs as today —
-  **no `index-pack`**. Estimate 150–250 lines + tests. **What it trades**: `index-pack` recomputes every object's id
-  from its content; a trusted idx moves "object id ⇔ content" onto the origin (authenticated, same origin as the bundle
-  and as the refs themselves — the origin already decides which id `main` points at, but today it cannot make id X
-  resolve to content Y). Keep `git fsck` the opt-in way to regain it; do **not** default it on.
-- **(b) A shallower history family** for the blobless clone (fewer objects to index; `git log` stops at the cut) —
-  addresses the 362.8 s, not the 1,063.6 s; needs the D18 history pack to be cut at a depth (new pack kind) and the
-  incrementals to chain to it. Separate decision; ~500 lines server-side, no client change.
-- **(c) `index.threads`/`pack.threads` via the installer**: nothing to gain — git already uses online CPUs, and the
-  floor is the single-threaded receive phase (280 s); memory limits do not move it.
-- **(d) Accept ≈ 18 min once per full clone**: the developer shape is the blobless clone (358 s, 6 GB), full clones
-  are CI/benchmarks; tolerable but the north star says "bytes move bucket → laptop", not "laptop re-indexes 32 GB".
-
-**Recommendation**: (a) for the weekly full first (the 1,000 s; zero new bucket bytes; reuses the client-patch channel we
-already need for `bundle.<id>.filter`), then reassess (b) with the blobless numbers; drop (c) and (d).
-
-## 7. Numbers to keep honest
-Measured 2026-08-21 06:05–06:52Z on the SSD host (44 cores, NVMe, same zone as the edge) against real churn on main
-(150–260 commits every 3 min); chain = import weekly + header-only daily + hourlies 04/05/06:00. Full detail and the
-trace2 breakdown from the local rig.
-
-| client | bytes through the front (`upload-pack`) | static bytes (edge/bucket) | front CPU | wall |
-|---|---|---|---|---|
-| fresh `clone` (bundle-uri) | **2.77 MB** = 49 min of pushes (**0.0085 %** of 32.70 GB) | 32.70 GB (weekly 32.3 GB from the edge cache at 305 MB/s, 3 hourlies, daily) | 3.3 s | 1,341.8 s — 1,140 s of it the client's `index-pack` of the weekly |
-| stale since the daily, `fetch` (bundle-uri) | **52.4 MB** (since the newest hourly) | 172 MB (one hourly: git stops at the first bundle whose prerequisite — the daily's tip — it has) | 5.1 s | 72.0 s (60 s client `index-pack`) |
-| same, bundle-uri off | **227 MB** | 0 | 11.7 s | 62.1 s (48.5 s client `index-pack`) |
-| sparse checkout `areas/core/storefront` + a branch on top | 0.5 KB | 0 | — | 7.4 s + 2.5 s |
-| CI clone `--filter=blob:none --depth=1` (`transfer.bundleURI=false`) | 58 MB | 0 | 4.4 s | 8.4 s (D18) |
-| **developer clone `--filter=blob:none`, today's advertised list** (2026-08-21 12:13Z) | — (aborted) | 32.3 GB weekly + hourlies | — | **≥ 1,398 s** (weekly 92 s download + 1,057 s `index-pack` for blobs it never asked for) |
-| **developer clone `--filter=blob:none --bundle-uri=…?filter=blob:none`** (the blobless family, 13:28Z) | ~0 (main unchanged since the base) | **6.0 GB** weekly-history | — | **431 s** = 67.6 s download (89 MB/s, one stream) + **362.8 s client `index-pack --promisor=from-bundle`** (43.6 M commits+trees; 15.8 s of it a `pack-objects --exclude-promisor-objects-best-effort`) + 0.3 s |
-| same, `--sparse --single-branch`, through the public path `git.example.com` (2026-08-22, laptop) | **26.6 KB** | 6.0 GB weekly-history + 5 incrementals (78 MB) | — | **358 s** = 58.7 s download + 281 s client `index-pack` + ~5 s incrementals; `git fetch` afterwards 0.6 s |
-| **full clone + checkout, end of day** (edge-cached measurement) | 75 MB (remainder = one push not yet in an hourly) | 32.31 GB weekly @ 480 MB/s + daily + 7 hourlies, all byte-exact | — | **1,499.9 s**: weekly download 67 s, **client `index-pack` 1,063.6 s (71 %)**, checkout 109 s for 1.47 M files |
-
-**The trade-off, stated plainly.** Bundles move bytes off the front: 4.3× fewer bytes and 2.3× less CPU for the stale
-fetch, 12,000× fewer bytes for the clone. They do not make one fast client on a warm NVMe server faster: the plain fetch
-won on wall time (62 vs 72 s) because the client's `index-pack` dominates both and resolves one big pack in one pass,
-while a bundle adds a second `index-pack` (43 s for 172 MB — thin deltas against the 32 GB base). Bundles win when what
-is scarce is the front (many clients, cold or small fronts, a tmpfs host), the path to it (a laptop, not a same-zone VM),
-or upload-pack itself (a cold base, a remote-served host); plain wins for a single client next to a warm SSD-backed host.
-Both are correct; `transfer.bundleURI` is the client's choice and the default we install. What moves the wall time: (a) **self-contained incrementals** — landed 2026-08-21 07:30Z (§5: −35 % client
-`index-pack`, +39 % static bytes; the 72 s stale fetch above was measured with thin bundles); (b) hourlies that are
-not cumulative when the daily is fresh (today one hourly = the whole day so far).
-
-Other numbers: weekly compose 32,312,706,666 B in ~2 s (bucket-side); hourly builds 4.8–7 s for 52–172 MB on the SSD host.
-**The remaining full-clone cost is the client's `index-pack` of the weekly** (§6 item: measure its phases; idea of
-pre-indexed delivery — the bundle's pack is byte-identical to `pack-<base>.pack`, whose `.idx`/`.rev` already sit in the
-bucket — needs a git-side change); developers take the blobless family instead (§6b: 431 s, of which 363 s is the same
-`index-pack` over 6 GB of commits+trees).
-**Where the blobless 431 s goes and the next levers**: 84 % is the client's `index-pack` of 43.6 M commit+tree objects
-(6 GB) — the history pack's object *count*, not its bytes; the download is 16 % and would halve with the edge cache
-warm / two streams. Levers, in order: (1) a **shallower history family** (e.g. `--filter=blob:none` + the last N months of
-commits as the full, older history lazily) cuts both; (2) `index-pack --threads` is already multi-threaded for delta
-resolution but the 43.6 M-object SHA-1/`write_idx` phase is single-threaded — nothing to do server-side; (3) ship the
-history pack's `.idx`/`.rev` alongside (git cannot use them from a bundle today). A full-worktree `checkout` on the
-blobless clone (1.47 M files) is the pathological case git itself warns about — `fetch --stdin` of 1.47 M blob wants
-spins a core client-side for > 35 min before any request reaches the server; developers use sparse-checkout (9.2 s for
-15.9 k files, §6).
-
-## 8. Open items
-- [ ] Land the filter-matching patch in a patched git before advertising full and blobless families together
-  (`docs/patches/README.md`, §6b).
-- [ ] Reduce client-side indexing of full/history bundles; evaluate pre-indexed delivery or a shallower history family (§7).
-- [ ] `packfile-uris` evaluation (serve the base pack itself as a static URI inside upload-pack) — likely
-      redundant with bundle-uri + D18; measure before building.
-- [ ] CDN in front of `/{o}/{r}/bundles/*` (immutable + Range already in place).
diff --git a/docs/CONTRACT.md b/docs/CONTRACT.md
index 12093f1..2aa7302 100644
--- a/docs/CONTRACT.md
+++ b/docs/CONTRACT.md
@@ -5,11 +5,9 @@ crates in parallel)**, kept as the reference for names and shapes. Rule still in
 — a type or function listed here is relied on by another crate. **Where this file and the code disagree, the
 code is right and this file is stale**; verify with `rg`/`cargo doc` before relying on a signature. Known
 supersessions (2026-08-20 sweep): `RepoHandle::sync()` is now the *Serve* level of the sync-level family
-(`sync_refs` / `sync` = Serve / `sync_full` / `sync_objects`, `AGENTS.md §2.3`); auth is Google identities only
-(`AGENTS.md §1.3`, no "admin token"); the server router is `web/API.md` + `AGENTS.md D15/D20/D26/D27`; bundle
-schedule/retention semantics are specified only by `docs/BUNDLE_URI_DESIGN.md §3–§4` (calendar slots,
-slot-epoch tokens, contiguous-chain retention, main-only refs). Read when you touch a crate boundary; update
-the relevant block when you extend one.
+(`sync_refs` / `sync` = Serve / `sync_full` / `sync_objects`, `AGENTS.md §2.3`); auth is none/token/oidc
+(`AGENTS.md §1.3`, with explicit admin principals); the server router is `web/API.md` + `AGENTS.md D15/D20/D26/D27`; the packfile replacement target is [PACKFILE_URI_DESIGN.md](PACKFILE_URI_DESIGN.md).
+Runtime bundle contracts are removed; retained protobuf messages exist only for durable replay.
 
 Shared interfaces between crates. Implement exactly these names/shapes; extend freely, do not rename.
 Original owners (parallel batch): StoreS3, StoreGcs, StoreCoord, GitEngine, Wal, Server, Bundle, Cli.
@@ -25,7 +23,9 @@ Read `AGENTS.md` first (design §1–§2, decisions §3; the original layout/pha
   `ObjectStoreExt`, `Prefixed`, `memory::MemoryStore`, `util::{collect,once,file_stream,backoff,retry}`),
   placeholder modules `coord.rs`, `gcs.rs`, `s3.rs`.
 - `walgit-config`: `Config` for walgit.toml (+ `WALGIT__` env overrides, `PORT`); `Config::with_settings` accepts
-  only `[bundles]`, `[maintenance]`, `[compaction]` and `[upstream]` in repo-scoped settings.
+  only `[maintenance]`, `[packs]`, `[upstream]`, `[refs]` and `[packfile_uri]` in repo-scoped settings.
+  `PacksConfig` owns lifecycle thresholds and whole-operation memory budgets; removed compaction keys are
+  rejected on host/new-write paths. Durable-only transition rules live in `PACKFILE_MIGRATION.md`.
 
 ## walgit-git (owner: GitEngine)
 
@@ -103,17 +103,11 @@ impl LocalRepo {
   pub struct RepackOptions { pub mode: RepackMode /* Geometric{factor} | Full */, pub write_bitmap: bool,
       pub write_midx: bool, pub keep: Vec<gix_hash::ObjectId> }
   pub struct RepackResult { pub new_packs: Vec<PackInfo>, pub removed: Vec<gix_hash::ObjectId> }
-  /// `git bundle create`.
-  pub async fn write_bundle(&self, out: &Path, refs: &[String], exclude: &[gix_hash::ObjectId])
-      -> Result<BundleInfo, GitError>;
-  pub struct BundleInfo { pub size: u64, pub pack_offset: u64 }
+
 }
-/// Bundle header ("# v2 git bundle\n" [+ "-<oid> prereq\n"]* + "<oid> <ref>\n"* + "\n") so a full bundle
-/// can be rendered as header + existing pack bytes without git.
-pub fn bundle_header(refs: &RefSnapshotData, prerequisites: &[gix_hash::ObjectId], format: ObjectFormat) -> Vec<u8>;
 
 pub mod pkt;      // pkt-line read/write, flush/delim/response-end, sideband encode; Protocol::{V0,V2} from
-                  // GIT_PROTOCOL header; command/arg parsing for v2 (ls-refs, fetch, object-info, bundle-uri)
+                  // GIT_PROTOCOL header; command/arg parsing for v2 (ls-refs, fetch, object-info)
 pub mod receive;  // parse receive-pack request: caps + commands ("old new refname\0caps"), push-options,
                   // => (walgit_proto::v1::RefTransaction, ReceiveCaps{report_status_v2, side_band_64k,
                   // atomic, quiet, push_options, agent, object_format}); pack bytes follow in the same body.
@@ -224,7 +218,7 @@ pub enum RefError { NonFastForward, Conflict{expected,actual}, Rejected(String),
 
 ```rust
 pub struct AppState { pub cfg: Arc<Config>, pub store: DynStore, pub registry: Arc<walgit_wal::Registry>,
-                      pub bundles: Arc<walgit_bundle::Bundler>, pub auth: Arc<auth::Authenticator> }
+                      pub auth: Arc<auth::Authenticator> }
 pub fn router(state: Arc<AppState>) -> axum::Router;
 /// Bind, serve (HTTP/1.1 + h2c), graceful shutdown on SIGTERM/SIGINT/`shutdown` future.
 pub async fn serve(state: Arc<AppState>, shutdown: impl Future<Output=()> + Send) -> anyhow::Result<()>;
@@ -233,61 +227,14 @@ pub async fn serve(state: Arc<AppState>, shutdown: impl Future<Output=()> + Send
 //   POST /git-upload-pack   POST /git-receive-pack   (Content-Encoding: gzip supported; streaming both ways)
 //   GET  /HEAD  GET /objects/info/packs (404 unless dumb enabled)
 //   POST /info/lfs/objects/batch  PUT/GET /info/lfs/objects/{oid}  POST /info/lfs/verify
-//   GET  /bundles/list  GET /bundles/{strategy}/{name}    (bundle-uri targets; ETag/Range/immutable caching)
 //   PUT  /  (create repo, write permission)   DELETE / (write permission)
 // Non-repo: GET /healthz /readyz /metrics ; GET / (list repos, text/plain)
 // Auth: verified Google identity; writes require write permission. Sync level depends on the endpoint
 // (Refs, Serve, Full, or Objects; AGENTS.md §2.3).
 ```
 
-## walgit-bundle (owner: Bundle)
-
-```rust
-pub struct Bundler; impl Bundler {
-  pub fn new(registry: Arc<Registry>, cfg: Arc<Config>) -> Arc<Self>;
-  /// Evaluate all strategies for `id` at `now`; build those due (leased per repo+strategy), upload
-  /// bundles/<strategy>/<ts>-<sha>.bundle, cas_update bundles/list.pb, prune keep=N. Returns built entries.
-  pub async fn run_due(&self, id: &RepoId, now: SystemTime) -> Result<Vec<BundleEntry>, BundleError>;
-  pub async fn build(&self, id: &RepoId, strategy: &str) -> Result<BundleEntry, BundleError>;
-  pub async fn list(&self, id: &RepoId) -> Result<Option<BundleList>, BundleError>;
-  /// git bundle-list text (bundle.version=1, bundle.mode, bundle.heuristic=creationToken, bundle.<id>.uri/
-  /// creationToken); uri = `{base_url}/{owner}/{repo}/bundles/{strategy}/{name}` or signed URL per config.
-  pub async fn render_list(&self, id: &RepoId, base_url: &str) -> Result<Option<String>, BundleError>;
-  /// v2 `bundle-uri` command response lines (key=value pkt-lines).
-  pub async fn protocol_v2_lines(&self, id, base_url) -> Result<Vec<String>, BundleError>;
-  pub async fn run_all_due(&self, now) -> Result<(), BundleError>; // every repo in registry.list()
-}
-
-/// Abstraction over the registry; `walgit_wal::Registry` implements it and tests may use any impl.
-#[async_trait]
-pub trait BundleSource: Send + Sync + 'static {
-  async fn open_repo(&self, id: &RepoId) -> Result<BundleRepoHandle, BundleError>;
-  async fn list_repos(&self) -> Result<Vec<RepoId>, BundleError>;
-}
-pub struct BundleRepoHandle {
-  pub local: walgit_git::LocalRepo,
-  pub store: walgit_store::Prefixed,
-  pub head_seq: u64,
-}
-/// `Bundler::new_with_source(source: Arc<dyn BundleSource>, cfg)` accepts custom sources;
-/// `Bundler::new(registry: Arc<Registry>, cfg)` delegates to it.
-pub use walgit_git::RepoId; // re-exported
-pub enum BundleError { Store, Decode, Git, StrategyNotFound, RepoNotFound, InvalidRepoId,
-  InvalidSchedule, Io, BundleNotFound, NoRefs, NoNewObjects, RetriesExhausted, Other }
-```
-
-### Proto addition (owner: Bundle)
-`BundleEntry` gains `repeated Ref tips = 11;` — the ref tips (name+oid+peeled) a
-bundle contains. For incremental bundles, the base bundle's tips are the
-prerequisites. Backward compatible (field 11 was unused).
-
-### Schedule / retention semantics
-Normative rules live in `docs/BUNDLE_URI_DESIGN.md §3–§4`: six-field UTC calendar slots, WAL state as of each
-slot, slot-epoch creation tokens, oldest-first backfill, contiguous-chain retention, and main-only selection
-where configured. Do not derive scheduling behavior from this interface catalog.
-
 ## walgit-cli (owner: Cli)
-`walgit --config walgit.toml <cmd>`: `serve` | `compact [owner/name|--all] [--once]` | `bundle run [--repo] [--strategy]` |
+`walgit --config walgit.toml <cmd>`: `serve` | `compact [owner/name|--all] [--once]` |
 `repo create|list|info` | `wal ls|show|materialize --at-seq` | `synth --out DIR --size s|m|l [--commits N --files M]`
 | `import --from GITDIR owner/name` | `config check|dump`. Also `Containerfile`, `compose.yaml` (rustfs +
 walgit), `justfile`, `walgit.example.toml`, `tests/e2e.sh` (real git vs. server on memory store and on rustfs).
diff --git a/docs/INTEGRITY.md b/docs/INTEGRITY.md
index 6cffb4a..142a198 100644
--- a/docs/INTEGRITY.md
+++ b/docs/INTEGRITY.md
@@ -56,8 +56,7 @@ finishes without redoing finished work; running it again on a completed import c
 - **Marker** `<pack dir>/../walgit-import/<owner>-<repo>.json`, keyed by the *intent* (repository + a hash of the
   exact ref set being published — a different `--refs` filter is a different import): the target manifest version
   when the import started, the seq it publishes at, the last completed phase (`started → verified → side-files →
-  history-pack → uploaded → bundled`), the **per-object done set** of uploaded store keys, the history pack path,
-  the composed bundle entry. Written after every phase and after every uploaded object (a kill loses at most one
+  history-pack → uploaded`), the **per-object done set** of uploaded store keys, the history pack path. Written after every phase and after every uploaded object (a kill loses at most one
   object's upload).
 - **Resume rule**: the marker is used only while the target's manifest version is still the one recorded; if the
   repository moved meanwhile (someone pushed or imported) the run refuses with the fix — `--force` starts over on the
diff --git a/docs/PACKFILE_MIGRATION.md b/docs/PACKFILE_MIGRATION.md
new file mode 100644
index 0000000..65640a0
--- /dev/null
+++ b/docs/PACKFILE_MIGRATION.md
@@ -0,0 +1,153 @@
+# Bundle removal and packfile migration
+
+Context: operators and reviewers moving existing walgit repositories to the
+[packfile design](PACKFILE_URI_DESIGN.md). This document describes a phased review and rollout plan.
+The bundle-removal review unit does not establish production packfile delivery, protected-client acceleration,
+or scale performance. Each later unit needs its own tests and compatibility decision before enablement.
+
+## Review stack
+
+1. Remove bundle runtime: crate/command, protocol command, list/catch-up routes, schedules, attempt caches,
+   configuration, recipes and UI. Keep ordinary dynamic clone/fetch and durable format decoders.
+2. Add independent group/discovery policy, exact coverage snapshots/certificates, append-only schema fields,
+   live/retired membership and CAS guards. Prove old-data replay before emitting URLs.
+3. Add conserving classification/folds/freezes/re-segmentation, repairable proofs, isolated producers,
+   resumable plan/step/seal, memory bounds and verified MIDX bitmap construction.
+4. Wire request selection, safe engine dispatch/splice, authenticated static serving and retired URL survival.
+5. Validate distributable clients, supported backend/edge combinations, complete UI/SDK/operator integration,
+   and publish representative correctness/performance receipts and the concrete rollback floor.
+
+Each review unit must build and preserve supported ordinary Git behavior. Stack position is not permission
+to leave a half-proved URI path enabled. Actual commits, test results and remaining gates belong in the PRs;
+this plan is not a test receipt.
+
+## Host configuration
+
+Remove `[bundles]` and every `[[bundles.strategy]]` table, `server.roles` entries named `bundle`, and
+`cache.bundle_list_entries`. The new parser rejects these removed host shapes. Environment override loaders
+that warn and ignore unknown keys are not migration tools: remove corresponding `WALGIT__BUNDLES__*` and
+cache overrides from the host's deployment configuration as well.
+
+The lifecycle layer replaces `[compaction]` with `[packs]`; old host keys and newly submitted old settings
+are rejected. The ordinary `compact` role remains. LFS `serve_via = "proxy"` or `"signed_url"` is unchanged.
+Use the documented lifecycle fields in `walgit.example.toml`: factor/count/age triggers, settlement freeze,
+ratio-driven re-segmentation, and bounded delta-search resources. There is no engine selector (Git performs
+packing), flat `trigger_bytes`, or `retention_superseded` knob. Remove corresponding old environment overrides.
+
+Use `walgit config check` with the actual host configuration/environment before restart. Compare rendered
+effective placement, auth, maintenance and upstream settings to the intended values.
+
+## Durable repository settings need an explicit transition
+
+Existing `RepoSettings.toml` is durable WAL data. Rejecting new `[bundles]` input must not erase that record or
+make log/checkpoint replay undecodable. It must also not silently discard unrelated overrides or widen ref
+visibility/object scope by falling back to broad host defaults.
+
+Before replacing old readers/writers, inspect each repository's saved settings and save its full document,
+revision and effective configuration. Using the existing administrative settings API/CLI, publish a reviewed
+replacement document that removes only bundle-specific sections while preserving maintenance,
+upstream and all other still-supported intent. For example:
+
+```toml
+# Before: stored by the bundle-serving release.
+[bundles]
+main_only = true
+[maintenance]
+checkpoints = false
+[upstream]
+follow = ["refs/heads/main"]
+```
+
+The replacement retains both `[maintenance]` and `[upstream]` exactly. The old bundle `main_only` policy is
+not a ref-advertisement policy or an exact future packing certificate. When introducing groups, choose its
+replacement deliberately from the saved intent; never reinterpret absence as permission to deliver every
+namespace. Preview/validate the replacement, publish through the normal SETTINGS transaction, and reread it.
+Coordinate concurrent settings writers during this transition; a whole-document replacement must not overwrite
+a newer administrator's change.
+
+The removal phase includes a durable-only read transition: it removes the obsolete bundle table from the
+in-memory settings document, warns, and applies the remaining supported overrides. Raw saved TOML and WAL
+history are preserved. Host files and newly published settings still reject the removed table. This bounded
+exception does not turn `main_only` or bundle ref filters into new group policy. Publishing the reviewed
+replacement document remains the explicit durable migration. A warning followed by dropping every override
+and using broad host defaults does not meet the gate.
+Historical SETTINGS entries stay intact and replayable; no bucket-wide rewriting or log mutation is authorized.
+Rollback/replay to a historical settings revision must apply the same transition checks before object work.
+
+## Saved compaction settings
+
+The lifecycle layer has a bounded read transition for old durable documents only. It preserves the raw saved
+record and maps supported intent into the effective config:
+
+| Saved compaction key | Effective packs key |
+|---|---|
+| enabled | enabled |
+| factor | geometric_factor |
+| trigger_packs | fold_when_fresh_packs_reach |
+| lease_ttl | lease_ttl |
+| engine = "git" | removed; native Git is the only producer |
+
+Old flat byte triggers do not have the same meaning as proportional fold thresholds. Time-limited retired
+pack retention contradicts issued-URL safety. If saved `trigger_bytes` or `retention_superseded` is present,
+the transition **disables pack maintenance** and warns until an administrator publishes reviewed `[packs]`
+settings. Ordinary serving remains available. It never guesses a size threshold or starts pruning objects.
+
+A document containing both old `[compaction]` and new `[packs]` fails validation rather than overwriting either
+one. Mapped fields must pass current validation; unsupported old values require an explicit rewrite. Other
+settings, including narrow ref selectors and upstream settings, remain intact. Preview the full replacement,
+publish through the settings API/CLI and verify the stored revision and effective values. This is bucket-data
+compatibility, not a host-config alias. Historical entries are never rewritten.
+
+## Durable schema and writer cutover
+
+Audit the public protobuf numbering before adding descriptors. Keep old bundle message decoders and checkpoint
+bundle-pointer fields, but stop using them for runtime delivery. Existing unclassified packs remain repository
+data; they are not static offers until classification and exact current-policy proofs establish eligibility.
+
+All writers that rewrite manifests must preserve exact snapshots and retired membership before those fields
+become authority. Stop incompatible readers and push, follow, import, checkpoint and maintenance writers before enabling new
+authority. A new format number alone cannot fence old binaries: the pre-migration readers do not validate
+`Manifest.format_version`. A future minimum-reader gate protects only readers that implement it; it cannot
+retroactively make deployed old readers safe.
+An older binary that drops these fields can invalidate issued URLs or proofs even if it can decode the message.
+The coverage-foundation writer uses canonical content-addressed ref snapshots and attempt-specific checkpoint
+metadata as soon as it runs; there is no separate snapshot-writing toggle. Complete the incompatible-writer
+stop before starting this binary against an existing bucket. Old checkpoint snapshots remain readable through
+their committed descriptor; readers must not reconstruct an old snapshot address from sequence alone.
+The rollback floor is therefore the earliest tested release preserving the new authority, not simply a binary
+that accepts the protobuf. A concrete compatible release hash must be recorded before enabling the new writer;
+none is certified by the removal unit.
+
+Test old manifest/log/checkpoint fixtures, current-settings migration and rollback/replay behavior. Exercise CAS
+retries and concurrent publication so stale plans cannot reintroduce retired members or erase proof descriptors.
+
+## Client transition
+
+New recipes stop writing `transfer.bundleURI`, `fetch.bundleURI`, or `--bundle-uri`. Existing clients may still
+have repository-local `fetch.bundleURI` pointing at removed catch-up routes. Explicitly remove that setting
+in affected clones; inspect global/origin-scoped configuration too if an operator previously added it. Do not
+silently rewrite users' global Git configuration as part of a server upgrade.
+
+Standard clients retain dynamic fetch/clone. `fetch.uriProtocols=https` can negotiate standard URI delivery on
+the native engine for anonymous-read repositories. Remote/gix serving stays dynamic. Protected URI acceleration requires a distributable, license-reviewed
+client with verified authenticated downloads; version strings alone are insufficient. Until that gate passes,
+document protected dynamic fallback honestly. Never open protected static routes to anonymous requests.
+
+Normal discovery advertises configured `refs.advertise` selectors, independently of packing groups. The
+default includes heads and tags. A complete v2 mirror or backup must explicitly request all namespaces:
+`git -c protocol.version=2 clone --mirror --server-option=ref-view=all <url>`; subsequent complete fetches
+also need `--server-option=ref-view=all`. This changes discovery, not authorization. Receive-pack continues
+to see the complete ref set. A v0 client uses the configured advertisement selectors.
+
+## Data retention and release evidence
+
+Removing code does not authorize deleting bucket data. Obsolete `bundles/` objects and checkpoint `.bundle`
+wrappers can be considered for a separate operator cleanup only after no reader/writer depends on them.
+Never delete `wal/`, manifests, logs, refs snapshots or real checkpoint metadata because a bundle wrapped them.
+Retired pack data and exact URI membership records are retained without a timeout/count cap in the new design.
+
+Before release, attach graph-equivalence, metadata-isolation, dependency-race, interrupted-download, auth/range,
+backend/edge, ordinary-client fallback, and engine-combination results. Include cold/truncated-read recovery,
+conserving maintenance and responsive-refs tests. Representative benchmarks must state exact byte units and
+measure server and client work, not just reduced application egress. Unfinished gates remain visible in the PR
+stack and release notes; the design document itself certifies none of them.
diff --git a/docs/PACKFILE_URI_DESIGN.md b/docs/PACKFILE_URI_DESIGN.md
new file mode 100644
index 0000000..8800544
--- /dev/null
+++ b/docs/PACKFILE_URI_DESIGN.md
@@ -0,0 +1,237 @@
+# Packfile delivery design
+
+Context: contributors replacing bundle delivery, implementing pack maintenance, or changing fetch and
+immutable HTTP serving. This is the design target for the packfile migration. The first review unit removes
+bundle runtime; the group, proof, lifecycle, and URI mechanisms below are not certified by that removal.
+Implementation and test receipts must accompany each later review unit. See [migration](PACKFILE_MIGRATION.md)
+for rollout gates and [round trips](ROUNDTRIPS.md) for the existing cost contract.
+
+## Implemented transport and remaining gates
+
+The native v2 path can deliver ordinary packs to anonymous-read clients that negotiate `http` or `https`
+packfile URIs. Exact current-policy certificates, live members and complete same-generation dependencies
+select a captured baseline; native Git sends the uncovered graph with thin-pack disabled. URI and optional
+index sections precede `packfile`, and synthetic-have ACKs are suppressed. Gix/remote engines stay dynamic.
+Protected clients stay dynamic until a distributable authenticated client is independently qualified;
+an index opt-in flag alone does not satisfy that release gate.
+
+`GET|HEAD /{owner}/{repo}[.git]/packfiles/{checksum}.pack` and `.idx` require ordinary read authorization
+and freshly revalidated live/retired manifest membership before conditional responses or byte offload.
+Protected responses use private immutable caching; optional loopback edge offload still requires admission
+on each request. Retired membership and bytes do not expire. No `.rev` delivery exists.
+
+The `packfile-indexes` fetch argument explicitly opts into an additional section containing
+`<pack-hash> <index-hash> <index-URL>`. Missing local index trailers omit that sidecar. This server framing
+does not qualify a trusted-index client: it must separately verify index hash, pack mapping, object count,
+header and integrity/trust settings. Stock clients do not request this extension.
+
+Selection shares at most three exact snapshot reads per request; the ordinary successful selection reads
+one snapshot. Threshold selection requires one worthwhile pack and retains small required companions,
+or falls back when the complete set exceeds the URI count cap. URLs sort by descending pack size then
+checksum. Shallow requests, unsupported filters, have-only negotiation, unknown wants, tag-only baselines
+without branch roots, and missing evidence remain dynamic. `blob:none` delivery selects proven history
+members only; it cannot treat mixed object packs as history. No optimal-cost or zero-extra-read claim is made.
+
+Default discovery follows `[refs].advertise`, independently of packing policy. For v2 mirror/backup tools
+that need every ordinary ref, use `git clone --mirror --server-option=ref-view=all <URL>` (and pass the same
+server option on later fetches). V0 follows the configured advertisement selectors; configure `refs/*`
+when full v0 discovery is required. Receive-pack advertisements remain complete.
+
+Model-to-code coverage, backend/edge validation, broader producer races and representative resource/performance
+acceptance remain separate release gates. Small stock-Git fixtures do not certify large-repository behavior.
+
+## 1. One repository inventory
+
+The object-store bucket remains the repository. Immutable ordinary Git packs, committed WAL entries,
+checkpoint/ref snapshots, and the CAS manifest are the only durable authority. Local indexes, materialized
+Git directories, and scratch jobs are caches. A successful push is acknowledged only after manifest CAS.
+
+Raw `wal/<checksum>.pack` objects become reusable delivery artifacts. A v2 fetch can offer HTTPS URLs for a
+proven subset and generate the uncovered requested graph through upload-pack. No second catalog, mutable
+bundle list, scheduled bundle wrapper, or client catch-up URL is needed. Small, bounded, unsupported, or
+unproven requests continue through dynamic Git transfer.
+
+## 2. Discovery and groups are independent
+
+Ref advertisement chooses names to show. Named object groups choose logical reachability. History/blob
+segments choose physical object types. These policies must not be conflated or treated as access controls.
+All outputs belong to the same ordinary Git object database.
+Identical physical packs are stored once and can belong to both code and metadata groups. Shared objects
+already reachable through a code group are ordinary code data; metadata-only objects must never enter its
+coverage. Such a shared pack carries a code audience label, but only an exact code-group certificate can
+make it eligible for ordinary URI delivery. Labels alone grant neither access nor coverage.
+
+Group configuration (available in the coverage foundation; transport wiring follows separately):
+
+```toml
+[refs]
+advertise = ["refs/heads/*", "refs/tags/*"]
+
+[refs.packfiles.code]
+kind = "code"
+include = ["refs/*"]
+subtract = []
+
+[refs.packfiles.meta]
+kind = "meta"
+include = ["refs/meta", "refs/meta/*"]
+```
+
+Selectors use full names or trailing byte-prefix `*`, ordered `!` exclusions, and last-match-wins semantics.
+`HEAD` resolves the symbolic default branch in the captured snapshot. Metadata roots are `refs/meta` and
+`refs/meta/*`; an auxiliary ref hidden from discovery is not automatically metadata. Normal code URI
+selection excludes metadata-only objects, while permitted explicit metadata requests remain dynamic.
+
+At captured generation `s`, the physical set of group `g` is its reachable closure minus the logical closure
+of every subtraction dependency. Dependencies form an acyclic graph between code groups. Selecting a group
+therefore requires its complete dependency certificates at that same generation, even if a dependency's pack
+is small. Settings merge group tables by name, inherit omitted fields, and replace arrays. New groups require
+kind and include selectors. Validate unknown fields, selectors, cycles, cross-kind subtraction and bounded
+configuration size. Proposed limits: 32 groups, 256 selectors per list, 16 KiB of definition bytes.
+
+The packing-policy identity includes group definitions/subtraction but excludes advertisement. Policy changes
+invalidate old eligibility, not repository data. Unmatched indexed objects and historical code surplus go into
+retained families; an empty include stops new group output but does not delete old objects. Narrow groups
+require exact scope bounds. Changing discovery must ship with an explicit full ordinary-ref view for wildcard
+consumers, so omitted names are not misinterpreted as deletions.
+
+## 3. Exact proofs and durable membership
+
+Extend protobuf fields append-only after auditing public field numbers. Keep old WAL/checkpoint decoders.
+Each usable coverage certificate must bind:
+
+- Group name and canonical current packing-policy identity.
+- Captured WAL sequence and exact content-addressed refs snapshot key.
+- The complete checksum set needed to reconstruct that group's closure.
+
+Snapshot bytes include sequence, object format, sorted refs, peeled targets, and symbolic HEAD. The digest
+must be verified. Publication binds the exact pointer; existence of a candidate object is not authority.
+Labels, tier 2, a global `covers_seq`, or a broad audience marker cannot replace the proof.
+
+Every publication CAS attempt rechecks prospective live members and scope. Retired members authorize old
+URLs only; they cannot support new coverage. Checkpoint trimming preserves snapshot descriptors needed by
+surviving proofs. A later push can coexist with an older complete baseline and arrive in the dynamic remainder.
+Missing proof triggers bounded coverage repair or dynamic fallback, not an automatic repository-wide cut.
+
+Static routes require ordinary repository read authorization and exact live or recorded-retired manifest
+membership. Lost-CAS candidates remain inaccessible even if their bytes exist. Retired checksum records and
+objects do not expire and are not count-capped: no general collector proves that every issued download has
+finished. Storage/manifest growth is an explicit tradeoff until a separate safe collection protocol exists.
+
+## 4. One conserving lifecycle
+
+Push/follow/import publish fresh inputs through the WAL. Independent geometric folds combine compatible
+families into tier-1 buffers, excluding frozen packs. Size or settlement freezes useful buffers into tier-2
+history and blob segments. Ratio-driven re-segmentation improves the global layout when sufficient new
+frozen material accumulates. A manual base operation uses the same mechanism; there is no weekly trigger.
+
+Lifecycle defaults include factor 2, 16 fresh packs, a one-day age arm requiring at least two packs, 14-day
+settlement, a 75% frozen target and a 0.5 re-segmentation ratio. Fresh-byte thresholds scale with repository
+size and the delivery floor. Missing scope classification or certificates is repaired independently.
+
+`[packs]` is the lifecycle configuration; `walgit.example.toml` documents every field. No alternate engine
+selector or retired-object timeout exists. Delta-search threads are resolved explicitly before invoking Git;
+zero configured threads means CPU detection, never an uncontrolled `--threads=0` subprocess. The whole-operation
+window-memory budget is clamped to host headroom and divided over the resolved thread count. GNU `sort` and
+`comm` provide bounded on-disk inventory operations; packaged runtimes include GNU coreutils.
+
+History contains commits, trees and tags; blobs have separate segments. Each segment is independently
+indexable, with all delta bases inside the pack. Git graph dependencies may cross segments and must be proved.
+Whole cuts preserve path names, order inputs deterministically and recompute deltas with `--no-reuse-delta`.
+Reusing compressed undeltified objects is permitted. Freezing a smaller already-self-contained fold may retain
+delta reuse. Never enumerate only reachable tips when conservation requires all indexed input objects.
+
+Budget delta-search memory across an explicit Git thread count, clamp for available host memory, and measure
+full RSS separately. A proposed 2 GiB target is 2,147,483,648 bytes, not decimal 2 GB. Resolve the intended cap
+before acceptance and test oversized-object behavior; `--max-pack-size` alone does not prove an absolute cap.
+
+Use isolated committed input views with explicit producer ownership. Pin index mappings before repack unlinks
+files; never infer a producer's output from a shared-directory before/after comparison. Heavy work stays on
+the bulk runtime with separate store transport permits. Refs remain responsive throughout.
+
+A resumable operation captures/pins, plans deterministic chunks, verifies each completed chunk, proves
+conservation, then seals. All chunks finish before sealing. Earlier COMPACT publications retire nothing; only
+the final publication retires inputs and establishes the complete replacement proof. Intermediate manifests
+may contain old and new packs. Per-attempt closure checks reject new holes; pre-existing holes remain visible
+for repair. Scratch markers are disposable progress, not durable jobs or cross-host resume authority.
+
+Maintain a real MIDX bitmap for segmented native Git reuse and verify that a bitmap was produced. Set native
+`pack.allowPackReuse=multi`; a successful MIDX command or ordinary `true` setting is insufficient evidence.
+Side-files accelerate reads but never establish object existence by themselves.
+
+## 5. Fetch negotiation and engine guards
+
+Advertise v2 `packfile-uris` capability independently of whether a repository currently has useful packs.
+Offer optional `packfile-indexes` only with the implemented extension contract. Select against wants, real
+haves, filter/depth, current policy and exact certificates before changing native negotiation.
+
+Useful sets contain at least one pack reaching a proposed 32 MiB floor, include small required companions,
+and remain within a proposed 64-URI cap. Over-cap sets fall back whole. Sort largest first, then checksum.
+All groups share at most three snapshot attempts. An older held baseline can remove members only with a
+conservative proof of client holdings, not an assumption that arbitrary topic haves cover default-branch history.
+
+| Request | Delivery target |
+|---|---|
+| Full code clone | Complete useful code/dependency set plus dynamic remainder |
+| Fresh full-history `blob:none` | History only; reject proofs needing omitted mixed OBJECTS data |
+| Shallow/deepen/other filters | Request-specific dynamic transfer |
+| Stale unfiltered fetch | New certified members only when older holdings are proved |
+| Metadata, unrelated OID, small or unproven request | Dynamic transfer |
+| Have-only negotiation | Real acknowledgments only, no pack or URI selection |
+
+The native splice appends proven roots as synthetic haves, suppresses only synthetic ACKs, and inserts URI
+and optional index sections before `packfile`. Preserve real ACKs, delimiters, progress, sideband-all,
+ready/done, wait-for-done and no-progress behavior. With any selected URI pack, disable thin encoding for the
+remainder: the graph is reduced but the dynamic pack is self-contained.
+
+**Every engine must either deliver the selected URLs or avoid synthetic subtraction.** Native, gix,
+remote-served and mount/local dispatch need explicit tests. A native-only first implementation must gate
+selection before it modifies requests that will take another engine. Capability advertisement is not a
+substitute for that guard.
+
+## 6. HTTP, clients and operational cost
+
+Advertised URLs use the normal repository origin and paths `/{owner}/{repo}.git/wal/<checksum>.pack` and
+`.idx`. Authorize before cache admission or offload. Refresh refs once on unknown membership before refusal.
+Preserve GET/HEAD, strong ETag, conditional 304, Range/206/416 and If-Range behavior. Weak/mismatched If-Range
+validators fall back to full bytes. A trusted edge must authenticate even warm cached requests; protected pack
+routes never become public to accommodate a client.
+
+| Client/access | Release contract |
+|---|---|
+| URI-capable client, intentionally anonymous reads | Standard packfile URI lane can accelerate once implemented/tested |
+| Stock or unsignalled client, protected repository | Dynamic fallback; narrate large full-clone cost |
+| Independently verified compatible auth/index client | Protected URI acceleration only after distribution/licensing and client validation gates |
+| v0 or no matching URI protocol | Dynamic transfer |
+
+`fetch.uriProtocols=https` enables standard URI negotiation; it does not add authenticated download behavior
+to stock clients. Authenticated transfer, credential refresh after 401, concurrency and trusted-index install
+require separately verified client support. Do not advertise an unknown config key as a stock-client feature.
+A trusted-index opt-in must verify pack/index checksums, structural bounds, embedded pack mapping and object
+count before atomic install, preserve keep/promisor semantics, and respect fsck restrictions. Missing indexes
+use ordinary index-pack. `.rev` transfer is outside this design's current implementation target.
+
+Default policy should not refuse compatible stock unbounded clones. Actual resource/placement limitations
+still apply and must produce prompt narrated errors rather than uncontrolled full materialization.
+
+Additional selection costs are normally one exact snapshot GET, at most three shared snapshot attempts, and
+possible uncached index-trailer range reads. Known manifest membership adds no separate lookup; an unknown
+checksum triggers one revalidation. Count depth and requests in simulator tests. Neither zero-extra-read
+selection nor a globally optimal cost selector is claimed.
+
+## 7. Acceptance before release
+
+Reconstruct URI packs plus remainder in empty clients and verify strict indexing/connectivity against ordinary
+Git for full, branch, tag, blobless, shallow, deepen, sparse, stale and explicit-OID requests. Negative controls
+must reject missing dependencies, stale policy, wrong generations, future members, partial seals and lost CAS.
+Inspect indexes to prove metadata exclusion and retained-object conservation. Pause downloads across repeated
+replacement/restarts and finish them successfully through retired membership.
+
+Test all auth modes, credential refresh, HTTP verbs/validators/ranges, warm edge cache denial, gix/native/remote
+engine dispatch, interrupted scratch jobs, corrupt/truncated side-files, producer isolation, concurrent pushes
+and checkpoint/settings races. Pin request budgets and refs responsiveness under stalled bulk work. Run both
+S3 and GCS contract suites under the public project's test workflow.
+
+Performance receipts must identify source/client versions, host/cache state, repository snapshot, raw commands
+and logs, static/dynamic bytes, client indexing and memory/disk cost. Compare the same graph against ordinary
+upload-pack and a global pack. A source port or small fixture pass is not representative scale evidence.
diff --git a/docs/ROUNDTRIPS.md b/docs/ROUNDTRIPS.md
index b8c930b..447af90 100644
--- a/docs/ROUNDTRIPS.md
+++ b/docs/ROUNDTRIPS.md
@@ -2,7 +2,7 @@
 
 Context: **who needs to read this, and when.** Anyone (human or agent) touching a protocol that talks to the
 bucket: the publish path (`walgit-wal/src/publish.rs`), sync levels and freshness (`sync.rs`, `handle.rs`),
-checkpoints, compaction and its lease (`walgit-server/src/ops.rs`, `coord.rs`), bundles (`walgit-bundle`),
+checkpoints, compaction and its lease (`walgit-server/src/ops.rs`, `coord.rs`), pack delivery,
 the remote reader, LFS, or the `ObjectStore` backends themselves — and anyone writing or triaging simulation
 scenarios (`crates/walgit-server/tests/sim.rs`), because a sim fix that is correct but adds a happy-path request
 is a regression, not a fix. Read it *before* designing the change, use §5 when writing the commit/PR, and
@@ -13,7 +13,7 @@ write-rate cap — so the number and shape of round trips *is* the performance d
 
 **Correct is necessary, not sufficient.** walgit's only durable primitive is a bucket with ~60–80 ms per
 request, one serialized overwrite per second per object, and no transactions beyond single-object CAS.
-Every protocol we design on top (publish, sync, compaction, checkpoints, bundles, leases) is judged on two
+Every protocol we design on top (publish, sync, compaction, checkpoints, pack delivery, leases) is judged on two
 axes at once:
 
 1. **Safety/liveness** — the simulation suite (`crates/walgit-server/tests/sim.rs`) and the contract tests.
@@ -41,15 +41,23 @@ right shape. This document is the thinking tool; apply it to every protocol chan
 |---|---|---|---|
 | Any read (`info/refs`, ls-refs, web refs/resolve) | 1 cond GET (or 0 within `freshness_ttl`) | 1 | `sync.rs::freshness_check` |
 | Cold Refs sync | 1 manifest GET → 1 round (checkpoint refs ∥ log tail segments) | no checkpoint: 1 + tail (2 with one segment); checkpoint: 2 + tail | `registry.rs::open`, `sync.rs` |
+| Old checkpoint without inline refs descriptor | manifest GET → committed checkpoint metadata GET → its refs GET (tail can overlap) | one additional GET compared with a new descriptor; the old address must come from committed metadata, never a guessed sequence path | `snapshots.rs::checkpoint_snapshot` |
 | Push request / publish (`process_batch`) | 1 freshness GET → pack PUT ∥ idx PUT ∥ log PUT (1 round) → manifest CAS (1 round) | request: 5; already-synced publish: 4 | `publish.rs` |
 | Compaction publish | same shape as push | — | `publish.rs::publish_compact_impl` |
+| Conserving lifecycle | acquire lease → captured refs/full sync → each output publishes additively → final seal (lease heartbeat → refs revalidation → immutable log PUT → manifest CAS) | one additive publication per new physical checksum and one final CAS; heartbeat GET/CAS calls and full-sync downloads are additional maintenance costs; no change to ordinary push/read budgets | `pack_lifecycle.rs`, `classification.rs::seal_pack_replacement` |
+| Coverage repair | captured snapshot Create → bounded batches of classification CAS → final certificate CAS | snapshot equality GET only on Create conflict; up to 128 classifications per batch; every certificate rechecks current policy and live membership | `pack_lifecycle.rs::repair_metadata` |
+| Native URI selection | existing fetch sync → exact coverage snapshot GET | normally +1 GET, shared maximum 3 attempts across all groups; current manifest/ref view capture adds no GET; optional index trailers are local bounded reads | `packfile_uri.rs::select`, `snapshots.rs::fetch_view` |
+| Static pack/index GET | manifest revalidation → object HEAD → body/range GET | 3 warm requests; conditional 304/HEAD omits the body GET; cold registry open may add its normal snapshot/tail reads; no pack materialization or LIST | `packfile_uri.rs::get`, `static_object.rs` |
 | Checkpoint | 1 cond GET (freshness) → refs PUT ∥ checkpoint PUT → manifest CAS | 3 rounds, 4 requests (was 6/6 until 2026-08-22: a bundle-list GET before the checkpoint PUT and a log GET for provenance times sat in the chain; times now come from the writer's own applied state, `bundle_key` is no longer looked up) | `checkpoint.rs` |
+| Validated remote index admission | warm valid index: 0 store requests; absent/corrupt index: index GET (HEAD first only for old descriptors with unknown size), at most four indexes downloading concurrently | unchanged healthy store depth; corruption now triggers repair instead of admitting bad evidence. Checksums, lock, mmap and cleanup are local work; no LIST. Per-index checksum CPU cost occurs when constructing a new remote inventory, not per object lookup. | `index_cache.rs`, `remote.rs` |
+| Final replacement evidence | coherent refs-level manifest capture → verified current index mappings → conservation/current-tip scan → existing log claim/CAS | warm indexes add 0 store requests; cold/bad evidence adds index GETs (HEAD only for unknown sizes), four concurrent downloads. O(refs) local capture and streaming index-union scan per CAS attempt; no pack download or LIST. This cost is not zero-read or constant-time seal certification. | `classification.rs`, `closure.rs`, `index_cache.rs` |
+| Lost CAS response resolution | fresh manifest GET; only if the exact segment descriptor is listed, GET and compare the claimed log bytes | normally +1 GET on this failure path compared with key/sequence-only resolution; no added successful-push requests. Missing/folded evidence remains unknown. Per-attempt nonce and actual frame sizes are computed locally. | `publish.rs::cas_landed` |
 | Settings publish (D24) | refs sync (conditional GET) → log slot PUT → manifest CAS; readers pay nothing extra (settings ride inline on the manifest) | 3 rounds; read: 0 | `publish.rs::publish_settings_impl` |
 | Lease acquire | 1 GET → 1 CAS put (or 1 Create when absent) | 2 | `coord.rs::try_acquire` |
 | Publish, local commit (2026-08-23) | unchanged in round trips: after the manifest CAS the ref txns are applied to the local copy **before** the new manifest version is advertised, both under `sync_mutex` (the refs phase of every sync); the reverse order let a reader cache the old refs under the new version, and without the lock a concurrent sync replayed the same entry (two `update-ref`, a lock collision). A landed CAS is answered `ok` whatever the local apply does — the next sync replays (one conditional GET that then returns 200, no extra write). | 0 extra | `publish.rs::process_batch` |
-| Weekly compose: refs at the base's seq (`refs_at_seq`, 2026-08-23) | checkpoint `refs.pb` at that seq: 1 GET; else newest checkpoint ≤ seq (2 GETs) + the log entries through the seq (already cached by the refs sync in practice) — replayed in memory, never a local write | 1, or 2 + tail | `log_reader.rs::refs_at_seq`, `bundles.rs::compose_full_from_base` |
-| Maintainer bundle pass, refs level (retention + settle closed slots) | 1 list GET → at most 1 CAS (retention) → at most **1 CAS for every verdict of the pass** (`record_skipped_many`; was one CAS per settled slot until 2026-08-22: a rig repo with 9,654 closed slots paid 9,654 CAS per pass and, past the 4,096-verdict cap, forever) | ≤ 3 | `walgit-bundle/src/lib.rs::settle_closed_slots`, `ops.rs::record_skipped_many` |
 | Repository listing (`/api/v1/owners*`, `/services/api/owners*`, maintainer/bridge passes) | 0 within `LIST_TTL` (30 s, per instance); else delimited `repos/` → (delimited `repos/<o>/` ∥ owners) → (HEAD `manifest.pb` ∥ repos): 3 rounds | 1 + owners + repos | `registry.rs::list` |
+| Bundle removal (2026-09-11) | v2 capabilities and narrated fetch: removed optional list GET (1 → 0 extra); maintenance no longer reads/CASes a bundle list; direct import no longer composes a wrapper or reads/CASes a bundle list | no new store requests; checkpoint and push budgets unchanged | `smart.rs`, `maintain.rs`, `import_direct.rs` |
+| Canonical checkpoint publication | unchanged: freshness → content-addressed refs PUT ∥ attempt-specific metadata PUT → manifest CAS | 4 healthy requests; equality verification GET only after immutable Create conflict | `checkpoint.rs`, `snapshots.rs` |
 | Orphan log slot (failure path only) | +1 fresh manifest GET, +HEAD per probe, +Create at next seq | — | `publish.rs::claim_log_slot` |
 
 `healthy_request_round_trip_budgets` in `crates/walgit-server/tests/sim.rs` pins the healthy MemoryStore
diff --git a/docs/announcing-walgit.md b/docs/announcing-walgit.md
index 1d83681..d21fc5d 100644
--- a/docs/announcing-walgit.md
+++ b/docs/announcing-walgit.md
@@ -1,3 +1,5 @@
+> Historical announcement. Its bundle delivery description predates the packfile migration; see [current design](PACKFILE_URI_DESIGN.md).
+
 # Announcing walgit: a git server that is one binary in front of a bucket
 
 *Draft announcement post. Publish alongside the repository.*
@@ -75,7 +77,7 @@ nix run github:tobi/walgit -- --config walgit.toml     # or: podman build -f Con
 ```
 
 The repository is at **github.com/tobi/walgit**, MIT licensed. `README.md` is the introduction; `AGENTS.md` is
-the architecture and the list of design decisions with their reasoning; `docs/BUNDLE_URI_DESIGN.md` is the bundle
+the architecture and the list of design decisions with their reasoning; `docs/PACKFILE_URI_DESIGN.md` is the current pack-delivery
 scheduler's design of record. The numbers we quote — 8-second CI clones, 32 GB of clone bytes with 2.8 MB through
 the server — come from the monorepo it was built for; the simulation suite (crashes, partitions, stale reads,
 lost responses) is how we keep the consistency story honest.
diff --git a/docs/patches/0001-bundle-uri-use-a-bundle-only-when-its-filter-matches.patch b/docs/patches/0001-bundle-uri-use-a-bundle-only-when-its-filter-matches.patch
deleted file mode 100644
index 7fa7469..0000000
--- a/docs/patches/0001-bundle-uri-use-a-bundle-only-when-its-filter-matches.patch
+++ /dev/null
@@ -1,257 +0,0 @@
-From ca1ef1193d20947df67ea250bcbb79f7cc7d6801 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Tobi=20L=C3=BCtke?= <tobi@users.noreply.github.com>
-Date: Fri, 21 Aug 2026 09:44:15 -0400
-Subject: [PATCH] bundle-uri: use a bundle only when its filter matches the
- clone's
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The bundle list format documents 'bundle.<id>.filter' ("The server uses
-this value to differentiate different kinds of bundles from which the
-client can choose those that match their object filters"), but the
-client never read it: every advertised bundle was downloaded and
-unbundled regardless. Two consequences on a server that offers both a
-whole-history family and a 'blob:none' family:
-
- * 'git clone --filter=blob:none' downloads the full bundles — for
-   a 57 GiB monorepo 32 GB of blobs it did not ask for, plus 17 minutes of
-   index-pack — before fetching the rest lazily anyway;
-
- * a plain 'git clone' unbundles the filtered bundles too
-   ('index-pack --promisor=from-bundle') and ends up a non-partial
-   clone holding promisor packs with objects it can never fetch
-   (observed: 3 promisor packs and 3 missing objects in a full clone).
-
-Parse 'bundle.<id>.filter' into remote_bundle_info and, before any
-bundle is downloaded (creationToken path and mode=all path, nested
-lists included), drop the bundles whose filter differs from the
-repository's partial-clone filter; no filter matches no filter.
-
-'git clone --filter' registers the promisor remote only after bundles
-are fetched, so clone passes its filter spec to bundle_uri_set_filter()
-first; 'git fetch' reads the repository's partialclonefilter. Skipped
-bundles are recorded as trace2 data 'bundle-uri/filter-skip'.
-
-Tested against walgit (tests/git-bundle-filter.sh there): one list with
-both families — a full clone takes only the unfiltered bundles (0
-promisor packs, fsck clean), a --filter=blob:none clone only the history
-ones (promisor packs from bundles, blobs lazy on checkout), a stale
-blobless fetch only the newer history incrementals.
----
- builtin/clone.c |   2 +
- bundle-uri.c    | 103 ++++++++++++++++++++++++++++++++++++++++++++++--
- bundle-uri.h    |  21 ++++++++++
- 3 files changed, 123 insertions(+), 3 deletions(-)
-
-diff --git a/builtin/clone.c b/builtin/clone.c
-index 5b25cca510..c4e7f1af43 100644
---- a/builtin/clone.c
-+++ b/builtin/clone.c
-@@ -1397,6 +1397,8 @@ int cmd_clone(int argc,
- 		transport_set_option(transport, TRANS_OPT_LIST_OBJECTS_FILTER,
- 				     spec);
- 		transport_set_option(transport, TRANS_OPT_FROM_PROMISOR, "1");
-+		/* bundles advertised with a filter are used iff it matches */
-+		bundle_uri_set_filter(spec);
- 	}
- 
- 	if (transport->smart_options && !deepen && !filter_options.choice)
-diff --git a/bundle-uri.c b/bundle-uri.c
-index 2bb2eb99e4..04eaa3d485 100644
---- a/bundle-uri.c
-+++ b/bundle-uri.c
-@@ -15,6 +15,7 @@
- #include "remote.h"
- #include "trace2.h"
- #include "odb.h"
-+#include "promisor-remote.h"
- 
- static struct {
- 	enum bundle_list_heuristic heuristic;
-@@ -54,6 +55,7 @@ static int clear_remote_bundle_info(struct remote_bundle_info *bundle,
- 	FREE_AND_NULL(bundle->id);
- 	FREE_AND_NULL(bundle->uri);
- 	FREE_AND_NULL(bundle->file);
-+	FREE_AND_NULL(bundle->filter);
- 	bundle->unbundled = 0;
- 	return 0;
- }
-@@ -223,6 +225,12 @@ static int bundle_list_update(const char *key, const char *value,
- 		return 0;
- 	}
- 
-+	if (!strcmp(subkey, "filter")) {
-+		free(bundle->filter);
-+		bundle->filter = *value ? xstrdup(value) : NULL;
-+		return 0;
-+	}
-+
- 	/*
- 	 * At this point, we ignore any information that we don't
- 	 * understand, assuming it to be hints for a heuristic the client
-@@ -537,6 +545,89 @@ static int compare_creation_token_decreasing(const void *va, const void *vb)
- 	return 0;
- }
- 
-+/*
-+ * The repository's partial-clone filter spec ("blob:none", ...), or NULL
-+ * when it is not a partial clone. During "git clone --filter=<f>" the
-+ * promisor remote is registered before bundles are fetched, so this is
-+ * the clone's filter too.
-+ */
-+static char *bundle_uri_clone_filter;
-+
-+void bundle_uri_set_filter(const char *spec)
-+{
-+	free(bundle_uri_clone_filter);
-+	bundle_uri_clone_filter = (spec && *spec) ? xstrdup(spec) : NULL;
-+}
-+
-+static const char *repo_partial_clone_filter(struct repository *r)
-+{
-+	struct promisor_remote *p;
-+
-+	/*
-+	 * "git clone --filter=<f>" registers the promisor remote only after
-+	 * the bundles are fetched (builtin/clone.c), so clone tells us.
-+	 */
-+	if (bundle_uri_clone_filter)
-+		return bundle_uri_clone_filter;
-+	if (!r->repository_format_partial_clone)
-+		return NULL;
-+	p = repo_promisor_remote_find(r, r->repository_format_partial_clone);
-+	if (!p || !p->partial_clone_filter || !*p->partial_clone_filter)
-+		return NULL;
-+	return p->partial_clone_filter;
-+}
-+
-+struct filter_prune_context {
-+	const char *filter;
-+	struct remote_bundle_info **drop;
-+	size_t nr, alloc;
-+};
-+
-+static int collect_filter_mismatch(struct remote_bundle_info *bundle,
-+				   void *data)
-+{
-+	struct filter_prune_context *ctx = data;
-+	int matches;
-+
-+	if (!bundle->filter)
-+		matches = !ctx->filter;
-+	else
-+		matches = ctx->filter && !strcmp(bundle->filter, ctx->filter);
-+
-+	if (!matches) {
-+		ALLOC_GROW(ctx->drop, ctx->nr + 1, ctx->alloc);
-+		ctx->drop[ctx->nr++] = bundle;
-+	}
-+	return 0;
-+}
-+
-+/*
-+ * Drop from 'list' every bundle whose advertised object filter differs
-+ * from the repository's partial-clone filter (none == none). A bundle
-+ * list may then carry several families at once (the whole history and a
-+ * "blob:none" history) and each clone takes only its own.
-+ */
-+static void prune_bundles_by_filter(struct repository *r,
-+				    struct bundle_list *list)
-+{
-+	struct filter_prune_context ctx = {
-+		.filter = repo_partial_clone_filter(r),
-+	};
-+	size_t i;
-+
-+	for_all_bundles_in_list(list, collect_filter_mismatch, &ctx);
-+	for (i = 0; i < ctx.nr; i++) {
-+		struct remote_bundle_info *bundle = ctx.drop[i];
-+
-+		trace2_data_string("bundle-uri", r, "filter-skip",
-+				   bundle->id ? bundle->id : "");
-+		hashmap_remove(&list->bundles, &bundle->ent, NULL);
-+		clear_remote_bundle_info(bundle, NULL);
-+		free(bundle);
-+	}
-+	free(ctx.drop);
-+}
-+
- static int fetch_bundles_by_token(struct repository *r,
- 				  struct bundle_list *list)
- {
-@@ -553,6 +644,8 @@ static int fetch_bundles_by_token(struct repository *r,
- 		.alloc = hashmap_get_size(&list->bundles),
- 	};
- 
-+	prune_bundles_by_filter(r, list);
-+	bundles.alloc = hashmap_get_size(&list->bundles);
- 	ALLOC_ARRAY(bundles.items, bundles.alloc);
- 
- 	for_all_bundles_in_list(list, append_bundle, &bundles);
-@@ -732,9 +825,12 @@ static int fetch_bundle_list_in_config_format(struct repository *r,
- 	if (list_from_bundle.heuristic == BUNDLE_HEURISTIC_CREATIONTOKEN) {
- 		result = fetch_bundles_by_token(r, &list_from_bundle);
- 		global_list->heuristic = BUNDLE_HEURISTIC_CREATIONTOKEN;
--	} else if ((result = download_bundle_list(r, &list_from_bundle,
--					   global_list, depth)))
--		goto cleanup;
-+	} else {
-+		prune_bundles_by_filter(r, &list_from_bundle);
-+		if ((result = download_bundle_list(r, &list_from_bundle,
-+						   global_list, depth)))
-+			goto cleanup;
-+	}
- 
- cleanup:
- 	clear_bundle_list(&list_from_bundle);
-@@ -908,6 +1004,7 @@ int fetch_bundle_list(struct repository *r, struct bundle_list *list)
- 	/* If a bundle is added to this global list, then it is required. */
- 	global_list.mode = BUNDLE_MODE_ALL;
- 
-+	prune_bundles_by_filter(r, list);
- 	if ((result = download_bundle_list(r, list, &global_list, 0)))
- 		goto cleanup;
- 
-diff --git a/bundle-uri.h b/bundle-uri.h
-index 6dbc780f66..571d5aead2 100644
---- a/bundle-uri.h
-+++ b/bundle-uri.h
-@@ -37,6 +37,17 @@ struct remote_bundle_info {
- 	 */
- 	char *file;
- 
-+	/**
-+	 * The object filter the bundle was created with, as advertised by
-+	 * "bundle.<id>.filter" (for example "blob:none"). NULL when the list
-+	 * advertised none: the bundle holds every object. A bundle is used
-+	 * only when this equals the repository's partial-clone filter
-+	 * (none == none): an unfiltered clone must not seed itself from a
-+	 * blobless bundle (it would hold promisor packs it cannot complete),
-+	 * and a blobless clone gains nothing from downloading every blob.
-+	 */
-+	char *filter;
-+
- 	/**
- 	 * If the bundle has been unbundled successfully, then
- 	 * this boolean is true.
-@@ -144,6 +155,16 @@ int fetch_bundle_uri(struct repository *r, const char *uri,
-  * Returns non-zero if there was an error trying to download the list
-  * or any of its advertised bundles.
-  */
-+/**
-+ * Tell the bundle-uri client the object filter of the clone in progress
-+ * ("blob:none", ...; NULL or "" = none) so bundles advertised with
-+ * "bundle.<id>.filter" are matched against it. "git clone --filter"
-+ * registers the promisor remote only after bundles are fetched, so it
-+ * must say so up front; "git fetch" needs nothing — the repository's
-+ * partial-clone filter is read from its config.
-+ */
-+void bundle_uri_set_filter(const char *spec);
-+
- int fetch_bundle_list(struct repository *r,
- 		      struct bundle_list *list);
- 
--- 
-2.54.0
-
diff --git a/docs/patches/README.md b/docs/patches/README.md
deleted file mode 100644
index 1e4d363..0000000
--- a/docs/patches/README.md
+++ /dev/null
@@ -1,26 +0,0 @@
-# Patches to git that walgit's design leans on
-
-Context: **client-side Git patch catalog and validation instructions** for engineers changing bundle selection
-or preparing the patched git. Read with `docs/BUNDLE_URI_DESIGN.md §6b` before enabling
-`bundles.advertise_filtered` or distributing a patched client.
-
-## `0001-bundle-uri-use-a-bundle-only-when-its-filter-matches.patch`
-**Candidate (not written, 2026-08-22)**: make `git fetch` honour `transfer.bundleURI` against the server's v2
-`bundle-uri` advertisement the way `git clone` does (today only `fetch.bundleURI=<list URI>` makes a fetch look at
-bundles; an advertised clone records merely `fetch.bundleCreationToken`, `builtin/clone.c` sets `fetch.bundleuri` only
-in the `--bundle-uri=` branch). Until then every walgit clone recipe passes `-c fetch.bundleURI=<list>`.
-
-Client-side matching of `bundle.<id>.filter` against the clone's object filter — the key the
-bundle-uri list format documents but git (2.47 … master) never read (see
-`docs/BUNDLE_URI_DESIGN.md` §6b and measurements for what that costs on
-acme/monorepo). With it, ONE advertised list can carry both the whole-history family and the
-`blob:none` history family (`bundles.advertise_filtered = true`), and each clone takes its own:
-
-- `git clone` → the unfiltered bundles only (no promisor packs, fsck clean);
-- `git clone --filter=blob:none` → the history bundles only (promisor packs from bundles,
-  blobs lazy on checkout); skipped bundles show up as trace2 data `bundle-uri/filter-skip`;
-- a stale blobless `git fetch` → the newer history incrementals only.
-
-Written against git `v2.55.0-602-g0c4de8e9a9`; applies to 2.54+ with `git am`. Test: `PATCHED_GIT=/path/to/built/git tests/git-bundle-filter.sh`
-(starts a local walgit with both families on one list; also shows stock git's defect: 3 promisor
-packs + 3 missing objects in a full clone). Until your clients carry it, the blobless family stays at `bundles/list?filter=blob:none`.
diff --git a/docs/spec/README.md b/docs/spec/README.md
new file mode 100644
index 0000000..c3adef7
--- /dev/null
+++ b/docs/spec/README.md
@@ -0,0 +1,122 @@
+# Bounded contract checks
+
+These models explore finite interleavings of publication, snapshots, replacement, delivery and retirement.
+They do not prove a refinement of Rust, validate Git pack bytes, or certify deployment performance. The
+executable inventory is [tlc/cases.tsv](tlc/cases.tsv); a checked-in row is not an execution receipt.
+
+Run `just spec` for the matrix plus the bounded reference and its old-value negative control. Use
+`just spec-fragments` to omit those two reference runs, or `just spec-full` to add larger reference arms.
+Java 11 or newer, Bash, ripgrep, curl, a SHA-256 utility and GNU timeout are required. Defaults are two JVM
+jobs, two workers and 2 GiB heap per job. Full reference runs are serial with eight workers and 8 GiB.
+Override `WALGIT_TLC_JOBS`, `WALGIT_TLC_WORKERS`, `WALGIT_TLC_HEAP` and `WALGIT_TLC_TIMEOUT` explicitly;
+the timeout defaults to 600 seconds per invocation. More jobs multiply the heap budget.
+
+Each invocation retains its own effective configuration, log and verdict under `target/test-logs/spec-*`.
+A fixed arm requires exit 0, the completion banner and an exhausted enumeration queue. A mutation or
+negated reachability witness requires exit 12 and exactly its named invariant. A temporal boundary requires
+exit 13 and its named property. Counterexamples require a trace and completion footer. Unexpected errors,
+deadlocks, timeouts, duplicate verdicts and truncated logs fail; `scripts/test-spec-runner.sh` checks these
+classifier rules without a JVM. A witness counterexample demonstrates reachability, not a failed guarantee.
+
+Finite fragments explicitly include the stuttering already allowed by their bracketed next-state relation.
+This does not change their temporal behavior or weaken their invariants. It lets TLC check with its normal
+deadlock detection enabled; it does not establish application deadlock freedom. Progress is a separate
+property with explicit fairness assumptions. Liveness configurations must not use symmetry reduction.
+Maintenance safety models do not prove eventual scheduling, repair deadlines or sustained convergence.
+
+## Public contract identifiers
+
+| ID | Obligation |
+|---|---|
+| C1 | An acknowledged publication is durable from the bucket alone. |
+| C2/C3 | Reads revalidate and use one committed snapshot; concurrent writers compose without regressing fields. |
+| C4 | Ref old values hold at the successful CAS, including retries. |
+| C5 | Complete submissions commit all-or-none; independent batch members remain independent. |
+| C6a/C6d | Current tips and candidate external dependencies are covered by the exact resulting committed inventory. |
+| C6b | Fetch omissions require honest negotiation: common closure, declared shallow boundaries, granted filters, negotiated thin bases, or **negotiated packfile URIs under exact coverage**. The URI case is the fifth lawful class. Never ACK synthetic roots to the client or subtract them on an engine that emits no URLs. |
+| C6c | Granted filters preserve on-demand access to reachable omitted objects. |
+| C7/C8 | Uncommitted candidates confer no serving authority; receipts distinguish committed, rejected and unknown outcomes. |
+| C9 | Ambiguous forwarding never causes local replay; duplicate no-op requests publish no new entry. |
+| C10a/C10b | Maintenance preserves objects and active historical reads. Issued URI records and bytes have no arbitrary expiry or cap. |
+| C15/C16 | Conditional termination and eventual folding require the stated fairness and finite-workload assumptions. |
+| B2 | Each CAS retry derives evidence from its newly captured basis. |
+| B5/B6 | Immutable identity is exact; multi-read operations never combine generations. |
+
+The bounded [WALContract](WALContract.tla) is a reference abstraction, not executable validation to install
+mechanically. Its fast bound of two pushes cannot reach a successful multi-ref transaction, and its original
+transaction pool cannot collect previously published objects. BatchPublication and MCTrim provide dedicated
+multi-ref and historical-trim witnesses. `MC_incomplete` intentionally violates `PushTerminates`: incomplete
+inputs have no rejection action in that frozen abstraction. Rust must instead reject missing inputs all-or-none
+within a bounded deadline; this control does not demonstrate a new Rust defect.
+
+WALCheckpoint assumes contiguous segments. Its `SegAtMin` equality is stronger than the concrete rules for
+burned sequence gaps and genesis and must not be copied into runtime validation. Segmented packs also invalidate
+an at-most-one-base invariant. ClosureProvenance and PackReplacement include hypothetical pruning mutations;
+public maintenance is conserving and exposes no pruning mode.
+
+## Model-to-code map
+
+The exact fixed arms, faults and negated witnesses are named in the matrix. A listed model can expose a
+required implementation obligation even while the corresponding Rust audit remains incomplete.
+
+| Contract | Public correction or boundary | Model / precise controls | Deterministic Rust or Git evidence |
+|---|---|---|---|
+| C2/C3, B5/B6 | Content-addressed coverage snapshots; committed checkpoint pointer; paired manifest/token/ref capture | SnapshotAuthority: guess/splice/cache; crossed/orphan witnesses. PublicationView: split capture | WAL coverage/checkpoint tests and serial simulation suite; further warm-race twins remain required |
+| C6b/C6c, B2 | Exact policy/member/dependency selection, shared snapshot budget, native splice and engine gates | PackCoverage: retire/scope/policy/dependency/generation/companion; retry/old/new/concurrent witnesses | `packfile_uri` selector tests; stock-Git SHA-1/SHA-256 filtered clone and checkout; native residual, metadata isolation and gix/protected fallback |
+| C6d/C10a | Exact captured inputs, raw indexed-link validation in isolated inputs, conserving disk-spooled families, additive output commits and per-attempt indexed conservation/current-tip checks at final seal | PackReplacement: raw/conserve/replace/supersedes; seal/refusal/race/retry witnesses. ClosureProvenance: boundary/tip/seal/retry/rival controls | `pack_segments` conservation/resume fixtures and WAL exact-seal tests; SHA-1/SHA-256 unreachable broken-link rejection and bounded metadata validation; real-index seal regression rejects lost unreachable objects and post-plan uncovered tips; candidate publication/raw-boundary gates and adversarial CAS-race twins remain open |
+| C2/C3 | Checkpoint anti-regression and composition against the current CAS basis | WALCheckpoint fixed/bug; ManifestComposition stale-base/no-checkpoint/no-tips and composite-story witnesses | Delayed-checkpoint test and simulation replay oracle; combined publisher/checkpointer/sealer twin remains required |
+| C5/C7/C8 | No-op receipts use seq 0 and publish no entry; empty-ref pack-only requests reject; unknown CAS remains typed unknown | BatchPublication: partial/isolation/retry/phantom/absence/noopphantom; atomic, late, folded and no-op witnesses | `noop_receipts_never_claim_a_siblings_log_entry`; `lost_cas_reply_is_resolved_or_unknown_without_losing_the_commit`; further late/overlaid failure twins remain required |
+| C3/C7, B5 | Per-claim nonce prevents content-token aliasing; lost-response resolution checks exact bytes | LogSlotClaim: burned retry/early sweep/ambiguous delete/deterministic bytes; retry/sweep/late witnesses | `recreated_claims_have_distinct_bytes_and_resolution_checks_identity`; orphan WAL and fault simulation tests; delayed-delete ABA twin remains required |
+| C9 | Disable redirects and transport retries; only pre-delivery failures permit local fallback | FrontReplay: ambiguous replay/connect taxonomy/no precondition/no-op publishing; fallback/recovery/quiet no-op witnesses | `ambiguous_delivery_and_gateway_responses_never_publish_locally`; no-op WAL receipt test |
+| C10b | Exact retired membership and retained bucket bytes | MCTrim: reader mutation and historical-trim witness | Protected retired pack/index download test; explicit pinned historical local-reader twin remains required |
+
+| C2/C3, B2 | Carry readiness only from an already-proven matching inventory; recheck revision-only changes after restart | ReadinessCarry: packs-only, no-carry, annotation/apply waste, stale opener, birth and empty-state controls | `readiness_carries_only_proven_inventory_and_rechecks_revision_only_restart` |
+| C7, B5/B6 | Validate index checksum, pack identity and count; replace damaged inodes and return opened mappings even after zero-download reuse | CacheDiscipline: presence/identity/reprove/fail-open/reader/sweep controls and rescue witnesses | `repairs_corrupt_and_wrong_identity_indexes_and_pins_old_readers` (both Git hash formats); publisher evidence integration remains required |
+| C10b | Attempt-owned temporary paths; cross-process kernel lock held by blocking workers through cancellation; reclaim only after acquiring that lock | TempReclaim: drop/sweep/dead-owner/interlock/age mutations; induction and ownership/recovery witnesses | `blocking_owner_keeps_lock_after_request_cancellation`; `killed_process_releases_ownership_before_residue_reclaim`; abandoned-temp recovery in the index test |
+
+### Cache abstraction boundaries
+
+CacheDiscipline is an obligation reference with separate probe, proof, repair and sweep windows. The public
+index cache serializes name operations across processes and returns mmap handles before releasing its lock;
+readers keep those handles across later removal. A stale sweep can discard a reusable name but cannot remove
+an active operation's unopened name. This is a different interlock from the model's atomic live-manifest
+sweep rule. The model does not establish a refinement of that lock or of future publisher evidence gates.
+
+TempReclaim models a PID registry with two processes and two lanes, including an inductive litter bound and
+its negative controls. Public index downloads instead use a kernel file lock and at most four concurrent
+attempts per repository cache. Blocking workers retain ownership after their async request is cancelled.
+Acquiring the lock permits reclaiming abandoned attempt names without age, PID reuse or namespace guesses.
+The reference's PID oracle and exact lane bound are not claims about this implementation. File count is not
+a byte-budget or eventual-reclamation proof; pack installation outside this index cache still needs its own
+cancellation/temporary-ownership audit. Both reference models retain their safety mutations and witnesses.
+
+## Remaining scope and limits
+
+Publisher cache-proof integration and cancellation/ownership auditing outside the remote index cache remain required.
+PolicyPinLocality and its 29 matrix arms are excluded: they require policy blobs addressed through a
+committed metadata ref, same-batch metadata writers and quarantine-backed policy resolution. This public
+tree loads `policy.json` once in `smart.rs` and saves it separately in `policy.rs`; none of those Git-policy
+operations exist. Importing that model would certify a different protocol. Concurrent policy-edit semantics
+are therefore not established by this packfile port; adding CAS-bound Git policy would be a separate design
+change. Per-submission independence remains covered by BatchPublication and its Rust receipt tests.
+
+Small downloads now reject clean early EOF and oversized bodies, with a deterministic failed-download/retry
+test. This does not close the full cold truncated-read readiness boundary. That boundary and
+seal-evidence cooldown remain open. Green model reruns do
+not close either gap. Producer quarantine/import, namespace recreation, resource limits, a distributable
+protected URI client, live backend/edge tests and representative performance measurements are separate gates.
+No model proves authentication, pack encoding, index hashes or Git wire correctness; real regression tests
+must cover those boundaries. There is no bucket collector in this port: PackCoverage assumes retention,
+MCTrim models a reader-safe collector, and neither proves an unimplemented collector.
+
+## Tool provenance
+
+The checksum-pinned jar is upstream TLA+ `v1.8.0`, revision
+`867aefb69ffc2452031292587b389d1fc3eb43ff`, built 2026-09-12. Its SHA-256 is
+`db131ddb48e7004d823bef4493df7b35694babe37505b9d9fa5685e7a331f1f1`; the downloaded bytes match the
+[release asset digest](https://github.com/tlaplus/tlaplus/releases/tag/v1.8.0) and jar manifest. This tag is
+rolling. A changed asset must fail checksum verification until provenance is reviewed and checks rerun.
+The [source range](https://github.com/tlaplus/tlaplus/compare/b123b22...867aefb) includes parser/diagnostic
+changes and empty-set equality, enumeration and fingerprint corrections; it is not a semantics-neutral
+update. Historical state counts are not reused as new evidence. The runner does not substitute another
+checker, especially one without equivalent result, liveness and input semantics.
diff --git a/docs/spec/WALContract.tla b/docs/spec/WALContract.tla
new file mode 100644
index 0000000..4c7231f
--- /dev/null
+++ b/docs/spec/WALContract.tla
@@ -0,0 +1,246 @@
+---------------------------- MODULE WALContract ----------------------------
+(***************************************************************************)
+(* Intent-level correctness contract: git host whose only durable state   *)
+(* is an object-store bucket, N ephemeral coordination-free instances,    *)
+(* stock git clients.  One repository (repos are independent, Q7).        *)
+(*                                                                         *)
+(* Environment axioms modeled, not proven: per-object CAS (CommitPush /   *)
+(* Fold atomicity on hist), immutable creation (objs monotone), no        *)
+(* multi-object txns (single hist), no fencing (no lease guards anywhere),*)
+(* crash-anywhere (stall + LoseAck + Crash), at-least-once (re-PushBegin),*)
+(* no clocks (no timing anywhere).                                        *)
+(***************************************************************************)
+EXTENDS Naturals, Sequences, FiniteSets
+
+CONSTANTS
+  Refs,        \* ref names, e.g. {rA, rB}
+  Vals,        \* abstract tips incl. None ("ref absent"), e.g. {None,v1,v2,v3}
+  None,
+  Objs,        \* abstract durable objects (the closure universe)
+  Reach,       \* [Vals -> SUBSET Objs]: closure of each tip
+  Clients,     \* symmetric
+  Instances,   \* symmetric
+  TxnPool,     \* abstract projections of complete, unfiltered submissions
+  MaxPushes,   \* bound on push attempts (model bound, not a system limit)
+  FoldBound    \* target unfolded-suffix length for T14
+
+ASSUME /\ None \in Vals /\ Reach[None] = {}
+       /\ \A v \in Vals : Reach[v] \subseteq Objs
+       /\ \A t \in TxnPool :
+            /\ t.refs \subseteq Refs /\ t.refs # {}
+            /\ t.old \in [t.refs -> Vals] /\ t.new \in [t.refs -> Vals]
+            /\ t.provides \subseteq Objs   \* objects the push carries
+
+VARIABLES hist, acked, objs, live, pend, nextId, rd, obs, view
+vars == <<hist, acked, objs, live, pend, nextId, rd, obs, view>>
+
+(* ------------------------- derived state ------------------------------ *)
+PushIdxs == { n \in 1..Len(hist) : hist[n].kind = "push" }
+
+RefsAt(n) ==                       \* fold of the first n entries (refs only)
+  LET F[m \in 0..n] ==
+        IF m = 0 THEN [r \in Refs |-> None]
+        ELSE IF hist[m].kind = "push"
+             THEN [r \in Refs |-> IF r \in hist[m].txn.refs
+                                  THEN hist[m].txn.new[r] ELSE F[m-1][r]]
+             ELSE F[m-1]           \* folds change no refs: T8 by construction
+  IN F[n]
+
+Cur       == RefsAt(Len(hist))
+Needed(n) == UNION { Reach[RefsAt(n)[r]] : r \in Refs }
+NeedOf(t) == UNION { Reach[t.new[r]]     : r \in t.refs }
+
+LastFold == IF \E n \in 1..Len(hist) : hist[n].kind = "fold"
+            THEN CHOOSE n \in 1..Len(hist) :
+                   /\ hist[n].kind = "fold"
+                   /\ \A m \in (n+1)..Len(hist) : hist[m].kind # "fold"
+            ELSE 0
+Unfolded == Cardinality({ n \in PushIdxs : n > LastFold })
+
+(* --------------------------- push lifecycle --------------------------- *)
+\* There is deliberately no client "atomic" bit: each selected TxnPool record
+\* is assumed to project one complete request and commits all-or-none. Ordering,
+\* push options, derived metadata, parsing and reporting are erased. PushBegin
+\* gives each attempt a fresh independent id; physical batches are not modeled.
+PushBegin(c) ==                    \* stock git: client states old/new per ref
+  /\ nextId <= MaxPushes
+  /\ \E t \in TxnPool :
+       pend' = [x \in DOMAIN pend \cup {nextId} |->
+                  IF x = nextId THEN [txn |-> t, stage |-> "new"] ELSE pend[x]]
+  /\ nextId' = nextId + 1
+  /\ UNCHANGED <<hist, acked, objs, live, rd, obs, view>>
+
+Upload(id) ==                      \* durable candidate creation; not committed state
+  /\ id \in DOMAIN pend /\ pend[id].stage = "new"
+  /\ objs' = objs \cup pend[id].txn.provides
+  /\ live' = live \cup pend[id].txn.provides
+  /\ pend' = [pend EXCEPT ![id].stage = "up"]
+  /\ UNCHANGED <<hist, acked, nextId, rd, obs, view>>
+
+CommitPush(id) ==                  \* THE linearization point: complete member
+  /\ id \in DOMAIN pend /\ pend[id].stage = "up"
+  /\ \A r \in pend[id].txn.refs :             \* per-ref old-value CAS   (T4)
+       Cur[r] = pend[id].txn.old[r]
+  /\ NeedOf(pend[id].txn) \subseteq live      \* closure durable at commit (T6)
+  /\ hist' = Append(hist, [kind |-> "push", id |-> id, txn |-> pend[id].txn])
+  /\ pend' = [pend EXCEPT ![id].stage = "cmt"]
+  /\ UNCHANGED <<acked, objs, live, nextId, rd, obs, view>>
+
+NackPush(id) ==                    \* truthful ng: mismatch is real (T11, Q4)
+  /\ id \in DOMAIN pend /\ pend[id].stage \in {"new", "up"}
+  /\ \E r \in pend[id].txn.refs : Cur[r] # pend[id].txn.old[r]
+  /\ pend' = [pend EXCEPT ![id].stage = "ng"]
+  /\ UNCHANGED <<hist, acked, objs, live, nextId, rd, obs, view>>
+
+AckPush(id) ==                     \* ok strictly after commit (T1, A)
+  /\ id \in DOMAIN pend /\ pend[id].stage = "cmt"
+  /\ acked' = acked \cup {id}
+  /\ pend' = [pend EXCEPT ![id].stage = "ack"]
+  /\ UNCHANGED <<hist, objs, live, nextId, rd, obs, view>>
+
+LoseAck(id) ==                     \* crash exit: committed, ok never delivered
+  /\ id \in DOMAIN pend /\ pend[id].stage = "cmt"
+  /\ pend' = [x \in DOMAIN pend \ {id} |-> pend[x]]
+  /\ UNCHANGED <<hist, acked, objs, live, nextId, rd, obs, view>>
+
+(* --------------------------- maintenance ------------------------------ *)
+Fold ==                            \* any instance, no lease; neutral (T8, T10)
+  /\ Unfolded > 0
+  /\ hist' = Append(hist, [kind |-> "fold", upto |-> Len(hist)])
+  /\ UNCHANGED <<acked, objs, live, pend, nextId, rd, obs, view>>
+
+Trim(S) ==                         \* OPTIONAL (non-property #13, Q2); guarded:
+  /\ S \subseteq live /\ S # {}
+  /\ S \cap Needed(Len(hist)) = {}                       \* current closure (T6)
+  /\ \A c \in Clients : rd[c].act =>                       \* active reads (Q3)
+       S \cap (UNION { Needed(j) : j \in rd[c].lo..Len(hist) }) = {}
+  /\ \A id \in DOMAIN pend : pend[id].stage = "up" =>      \* pending push (Q10)
+       S \cap NeedOf(pend[id].txn) = {}
+  /\ live' = live \ S
+  /\ UNCHANGED <<hist, acked, objs, pend, nextId, rd, obs, view>>
+
+(* ------------------------------ reads --------------------------------- *)
+ReadBegin(c) ==
+  /\ ~rd[c].act
+  /\ rd' = [rd EXCEPT ![c] = [act |-> TRUE, lo |-> Len(hist)]]
+  /\ UNCHANGED <<hist, acked, objs, live, pend, nextId, obs, view>>
+
+\* Any instance may serve, warm or cold; there is no view[i] guard (T9/T10).
+ReadEnd(c, i) ==
+  /\ rd[c].act     \* Linearizes at some instant within the window (T2, T3):
+  /\ \E j \in rd[c].lo..Len(hist) :   \* served bytes := RefsAt(j) + its closure
+       /\ obs'  = [obs  EXCEPT ![c] = j]
+       /\ view' = [view EXCEPT ![i] = IF j > view[i] THEN j ELSE view[i]]
+  /\ rd' = [rd EXCEPT ![c] = [act |-> FALSE, lo |-> 0]]
+  /\ UNCHANGED <<hist, acked, objs, live, pend, nextId>>
+
+(* --------------------------- failure model ---------------------------- *)
+Crash(i) ==        \* instance loses ALL local state; also models cold start.
+  /\ view' = [view EXCEPT ![i] = 0]    \* warmth only (T1/T9)
+  /\ UNCHANGED <<hist, acked, objs, live, pend, nextId, rd, obs>>
+  \* In-flight pushes stalling forever ≈ their instance crashed (no fairness
+  \* is attached to any single op unless we assert T12).
+
+(* ------------------------------ spec ---------------------------------- *)
+Init == /\ hist = <<>> /\ acked = {} /\ objs = {} /\ live = {}
+        /\ pend = [x \in {} |-> x] /\ nextId = 1
+        /\ rd  = [c \in Clients |-> [act |-> FALSE, lo |-> 0]]
+        /\ obs = [c \in Clients |-> 0]
+        /\ view = [i \in Instances |-> 0]
+
+Next == \/ \E c \in Clients : PushBegin(c) \/ ReadBegin(c)
+        \/ \E c \in Clients, i \in Instances : ReadEnd(c, i)
+        \/ \E id \in DOMAIN pend :
+             Upload(id) \/ CommitPush(id) \/ NackPush(id)
+                        \/ AckPush(id)    \/ LoseAck(id)
+        \/ Fold
+        \/ \E S \in SUBSET Objs : Trim(S)
+        \/ \E i \in Instances : Crash(i)
+
+Fairness ==        \* needed ONLY by T12/T13/T14; safety holds without any.
+  /\ \A id \in 1..MaxPushes :
+       /\ WF_vars(Upload(id)) /\ WF_vars(AckPush(id))
+       /\ SF_vars(CommitPush(id) \/ NackPush(id))
+          \* SF encodes "contention eventually resolves" — stronger than the
+          \* design promises (Q5); with WF only, alternating CAS losers is a
+          \* legal run and T12's success clause fails. Deliberate and flagged.
+  /\ \A c \in Clients, i \in Instances : WF_vars(ReadEnd(c, i))
+  /\ WF_vars(Fold)
+  \* NO fairness on Crash, Trim, PushBegin: they may happen anytime or never.
+
+Spec == Init /\ [][Next]_vars /\ Fairness
+
+(* ========================= THE CONTRACT ================================ *)
+
+(* Contract mapping (docs/spec/README.md §2):                               *)
+(*   C1=AckedCommitted   C2=ReadFresh   C3=Mono   C4=HistPreconds          *)
+(*   C6a=ClosureLive   C8=AckAfterCommit                                  *)
+(*   C10b=Trim's guard   C15=PushTerminates+ReadsTerminate                 *)
+(*   C16=EventuallyFolded   C10a/C11/C12 = by construction (README §7)     *)
+(* C5b's ref-state core is structural under the whole-request assumption.    *)
+(* Policy/reporting/batching are refinement obligations. Raw candidate-byte   *)
+(* serving is not modeled: Upload adds closure-check availability only.       *)
+
+(* ---- state invariants (SAFETY) ---- *)
+TypeOK ==
+  /\ acked \subseteq 1..MaxPushes /\ live \subseteq objs /\ objs \subseteq Objs
+  /\ \A n \in 1..Len(hist) : hist[n].kind \in {"push", "fold"}
+  /\ \A c \in Clients : obs[c] \in 0..Len(hist) /\ rd[c].lo \in 0..Len(hist)
+
+AckedCommitted ==   \* T1 (with objs durability via ClosureLive + Mono)
+  \A id \in acked : \E n \in PushIdxs : hist[n].id = id
+
+\* T4: every committed txn's old values matched its prior state.
+HistPreconds ==
+  \A n \in PushIdxs : \A r \in hist[n].txn.refs :
+     RefsAt(n-1)[r] = hist[n].txn.old[r]
+
+ClosureLive ==      \* T6: the published state is self-contained, always
+  Needed(Len(hist)) \subseteq live
+
+NoPhantomPush ==    \* T7: every committed txn traces to a client request
+  \A n \in PushIdxs : hist[n].id < nextId
+
+(* T15, OPTIONAL — check only with Trim disabled, or windowed per Q2: *)
+ProvenanceAll == \A n \in 0..Len(hist) : Needed(n) \subseteq live
+
+(* ---- action properties ([][...]_vars) ---- *)
+Mono ==             \* T3 (append-only, no rollback) + monotone acks/objs +
+  [][ /\ acked \subseteq acked' /\ objs \subseteq objs'   \* monotone sessions
+      /\ Len(hist') >= Len(hist)
+      /\ \A n \in 1..Len(hist) : hist'[n] = hist[n]
+      /\ \A c \in Clients : obs'[c] >= obs[c] ]_vars
+
+\* T2: a read never returns anything older than its window floor.
+ReadFresh ==
+  [][ \A c \in Clients :
+        (rd[c].act /\ ~rd'[c].act) => obs'[c] >= rd[c].lo ]_vars
+  \* T2 end-to-end: at ReadBegin, lo = Len(hist) >= index of every already-acked
+  \* push (AckedCommitted + Mono), so the served j >= lo covers them all.
+
+AckAfterCommit ==   \* T1/T11: ok never precedes commit
+  [][ \A id \in 1..MaxPushes :
+        (id \in acked' /\ id \notin acked) =>
+           \E n \in PushIdxs : hist[n].id = id ]_vars
+
+(* ---- temporal properties (LIVENESS; require Fairness) ---- *)
+PushTerminates ==   \* T12 (LoseAck counts: visible connection failure)
+  \A id \in 1..MaxPushes :
+    (id \in DOMAIN pend) ~>
+       (id \notin DOMAIN pend \/ pend[id].stage \in {"ack", "ng"})
+
+ReadsTerminate ==   \* T13
+  \A c \in Clients : rd[c].act ~> ~rd[c].act
+
+EventuallyFolded == \* T14 (meaningful because PushBegin is bounded: quiescence)
+  <>[](Unfolded <= FoldBound)
+
+(* C5b/T5's ref-state projection, T8 (fold neutrality), and T9 (cold-start
+   fidelity) are BY CONSTRUCTION here: the model assumes one complete request
+   per txn and uses one hist entry per push; fold entries skip refs in RefsAt,
+   and no property mentions view. Parsing, ordering, policy, reports, broker
+   forwarding, and physical group batching remain refinement obligations.
+   For the abstract spec these properties are
+   structural; for implementations they are refinement obligations (§4d),
+   which is exactly where the design places the burden.                     *)
+=============================================================================
diff --git a/docs/spec/scratch/BatchPublication.cfg b/docs/spec/scratch/BatchPublication.cfg
new file mode 100644
index 0000000..ee91bd4
--- /dev/null
+++ b/docs/spec/scratch/BatchPublication.cfg
@@ -0,0 +1,14 @@
+SPECIFICATION Spec
+CONSTANTS
+  Scenario = "race"
+  Fault = "none"
+INVARIANTS
+  TypeOK
+  SubmissionAtomic
+  DecisionIsolation
+  CommitPreconditions
+  NoLostUpdate
+  WriteAhead
+  ReportsTruthful
+  NoopReceiptTruthful
+  AtMostOnce
diff --git a/docs/spec/scratch/BatchPublication.tla b/docs/spec/scratch/BatchPublication.tla
new file mode 100644
index 0000000..ba74da8
--- /dev/null
+++ b/docs/spec/scratch/BatchPublication.tla
@@ -0,0 +1,282 @@
+------------------------ MODULE BatchPublication ------------------------
+(* C4/C5/C7/C8, B2/B3/B7. Two publishers, each used once; the first
+   has two independent submissions. Capture/validation, upload, send, store
+   CAS, response and resolution are separate steps. A timed-out request may
+   land AFTER the caller has returned unknown. Checkpointing can erase the
+   positive evidence without undoing the commit. No clocks or leases.
+
+   Refinement targets: publish.rs process_batch, cas_landed and finish_unknown.
+   Upload/connectivity/authorization failure is abstracted by Allowed and by
+   UploadFail; this is NOT a model of the serving ODB's raw-object quarantine.
+   Fault changes one guard; the oracles below never depend on Fault. *)
+EXTENDS Integers, Sequences, FiniteSets, TLC
+CONSTANTS Scenario, Fault
+ASSUME Scenario \in {"race", "denied", "missing", "policy", "dependent", "delete", "noop", "rejectednoop"}
+ASSUME Fault \in {"none", "policy", "partial", "isolation", "retry", "earlyack", "absence", "phantom", "noopphantom"}
+Writers == {1, 2}
+Refs == {"a", "b", "meta"}
+Zero == [r \in Refs |-> 0]
+Txn(rs, old, new, allowed, policy) ==
+  [refs |-> rs, old |-> old, new |-> new, allowed |-> allowed, policy |-> policy]
+CreateA == Txn({"a"}, 0, 1, {"a"}, -1)
+CreateB == Txn({"b"}, 0, 1, {"b"}, -1)
+Atomic == Txn({"a", "b"}, 0, 1, {"a", "b"}, -1)
+Denied == Txn({"a", "b"}, 0, 1, {"a"}, -1)
+Missing == Txn({"a", "b"}, 0, 1, {}, -1)
+Policy == Txn({"meta"}, 0, 1, {"meta"}, -1)
+Guarded == Txn({"a"}, 0, 1, {"a"}, 0)
+Update == Txn({"a"}, 1, 2, {"a"}, -1)
+Delete == Txn({"a"}, 1, 0, {"a"}, -1)
+\* Fixed points: old = new. NoopAfter holds only in the OVERLAY world where
+\* the batchmate's CreateA penciled a=1 -- the exact seam where a no-op's
+\* receipt can outrun the commit it depends on. NoopZero holds against the
+\* durable capture (delete-absent), the lawful standalone no-op.
+NoopAfter == Txn({"a"}, 1, 1, {"a"}, -1)
+NoopZero == Txn({"a"}, 0, 0, {"a"}, -1)
+Batch(w) ==
+  CASE Scenario = "race" -> IF w = 1 THEN <<Atomic, CreateB>> ELSE <<CreateA>>
+    [] Scenario = "denied" -> IF w = 1 THEN <<Denied, CreateB>> ELSE <<CreateA>>
+    [] Scenario = "missing" -> IF w = 1 THEN <<Missing, CreateB>> ELSE <<CreateA>>
+    [] Scenario = "policy" -> IF w = 1 THEN <<Policy, Guarded>> ELSE <<Guarded>>
+    [] Scenario = "dependent" -> IF w = 1 THEN <<CreateA, Update>> ELSE <<CreateB>>
+    [] Scenario = "delete" -> IF w = 1 THEN <<CreateA, Delete>> ELSE <<CreateA>>
+    [] Scenario = "noop" -> IF w = 1 THEN <<CreateA, NoopAfter>> ELSE <<NoopZero>>
+    \* Rejected + no-op: the denied member never pencils the overlay, so the
+    \* no-op classifies against captured refs and the early exit answers
+    \* both -- rejection for one, ok for the other, no slot, no CAS.
+    [] Scenario = "rejectednoop" -> IF w = 1 THEN <<Denied, NoopZero>> ELSE <<CreateA>>
+
+Allowed(t, s) ==
+  {r \in t.refs : r \in t.allowed /\ s[r] = t.old}
+PolicyOK(t, s) == t.policy = -1 \/ s["meta"] = t.policy
+Mask(t, s, fault) ==
+  IF ~(PolicyOK(t, s) \/ fault = "policy") THEN {}
+  ELSE IF fault = "partial" THEN Allowed(t, s)
+  ELSE IF Allowed(t, s) = t.refs THEN t.refs ELSE {}
+Apply(s, t, mask) == [r \in Refs |-> IF r \in mask THEN t.new ELSE s[r]]
+Plan(w, s, fault) ==
+  LET P[n \in 0..Len(Batch(w))] ==
+        IF n = 0 THEN [state |-> s, masks |-> <<>>]
+        ELSE LET t == Batch(w)[n]
+                 m == Mask(t, P[n-1].state, fault)
+             IN [state |-> Apply(P[n-1].state, t, m),
+                 masks |-> Append(P[n-1].masks, m)]
+      p == P[Len(Batch(w))]
+  IN IF fault = "isolation" /\ {} \in {p.masks[n] : n \in DOMAIN p.masks}
+     THEN [state |-> s, masks |-> [n \in DOMAIN p.masks |-> {}]] ELSE p
+Accepted(p) == UNION {p.masks[n] : n \in DOMAIN p.masks} # {}
+\* A no-op submission: accepted with a full mask AND changing nothing.
+IsNoop(w, p, n) ==
+  /\ p.masks[n] = Batch(w)[n].refs
+  /\ Batch(w)[n].old = Batch(w)[n].new
+HasNoop(w, p) == \E n \in DOMAIN p.masks : IsNoop(w, p, n)
+\* Every accepted submission is a no-op: the publisher's early exit --
+\* report ok, claim no slot, CAS nothing (process_batch's all-no-op path).
+AllNoop(w, p) ==
+  /\ Accepted(p)
+  /\ \A n \in DOMAIN p.masks : p.masks[n] # {} => IsNoop(w, p, n)
+
+VARIABLES refs, rev, history, evidence, phase, base, token, plan, uploaded,
+          wire, report, retried, late, folded, noopok
+vars == <<refs, rev, history, evidence, phase, base, token, plan, uploaded,
+          wire, report, retried, late, folded, noopok>>
+Init ==
+  /\ refs = Zero /\ rev = 0 /\ history = <<>> /\ evidence = {}
+  /\ phase = [w \in Writers |-> "capture"]
+  /\ base = [w \in Writers |-> Zero] /\ token = [w \in Writers |-> 0]
+  /\ plan = [w \in Writers |-> Plan(w, Zero, "none")]
+  /\ uploaded = {} /\ wire = [w \in Writers |-> "none"]
+  /\ report = [w \in Writers |-> "none"]
+  /\ retried = {} /\ late = {} /\ folded = {} /\ noopok = {}
+
+Capture(w) ==
+  /\ phase[w] = "capture"
+  /\ base' = [base EXCEPT ![w] = refs]
+  /\ token' = [token EXCEPT ![w] = rev]
+  /\ plan' = [plan EXCEPT ![w] = Plan(w, refs, Fault)]
+  /\ phase' = [phase EXCEPT ![w] = "prepared"]
+  /\ UNCHANGED <<refs, rev, history, evidence, uploaded, wire, report, retried, late, folded, noopok>>
+
+Reject(w) ==
+  /\ phase[w] = "prepared" /\ ~Accepted(plan[w])
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] = "ng"]
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded, noopok>>
+
+Upload(w) ==
+  /\ phase[w] = "prepared" /\ Accepted(plan[w]) /\ ~AllNoop(w, plan[w])
+  /\ uploaded' = uploaded \cup {w}
+  /\ phase' = [phase EXCEPT ![w] = "send"]
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, wire, report, retried, late, folded, noopok>>
+
+UploadFail(w) ==
+  /\ phase[w] = "prepared" /\ Accepted(plan[w]) /\ ~AllNoop(w, plan[w])
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] = "ng"]
+  /\ noopok' = IF Fault = "noopphantom" /\ HasNoop(w, plan[w])
+                 THEN noopok \cup {w} ELSE noopok
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded>>
+
+\* The all-no-op early exit: every ACCEPTED submission already holds, so the
+\* publisher answers ok and touches neither slot nor CAS. Rejected members
+\* may coexist (they never pencil the overlay and get their definitive
+\* rejection); only a batch with an accepted PUBLISHING member skips this
+\* path.
+NoopSettle(w) ==
+  /\ phase[w] = "prepared" /\ AllNoop(w, plan[w])
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] = "ok"]
+  /\ noopok' = noopok \cup {w}
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded>>
+
+Send(w) ==
+  /\ phase[w] = "send"
+  /\ wire' = [wire EXCEPT ![w] = "pending"]
+  /\ phase' = [phase EXCEPT ![w] = "wait"]
+  /\ report' = [report EXCEPT ![w] = IF Fault = "earlyack" THEN "ok" ELSE @]
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, retried, late, folded, noopok>>
+
+Land(w) ==
+  /\ wire[w] = "pending" /\ token[w] = rev
+  /\ refs' = plan[w].state /\ rev' = rev + 1
+  /\ history' = Append(history, [writer |-> w, before |-> refs,
+        after |-> plan[w].state, masks |-> plan[w].masks, durable |-> w \in uploaded])
+  /\ evidence' = evidence \cup {w}
+  /\ wire' = [wire EXCEPT ![w] = "committed"]
+  /\ late' = IF report[w] = "unknown" THEN late \cup {w} ELSE late
+  /\ UNCHANGED <<phase, base, token, plan, uploaded, report, retried, folded, noopok>>
+
+Conflict(w) ==
+  /\ wire[w] = "pending" /\ token[w] # rev
+  /\ wire' = [wire EXCEPT ![w] = "conflict"]
+  /\ UNCHANGED <<refs, rev, history, evidence, phase, base, token, plan, uploaded, report, retried, late, folded, noopok>>
+
+Reply(w) ==
+  /\ phase[w] = "wait" /\ wire[w] = "committed"
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] = "ok"]
+  /\ noopok' = IF HasNoop(w, plan[w]) THEN noopok \cup {w} ELSE noopok
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded>>
+
+Retry(w) ==
+  /\ phase[w] = "wait" /\ wire[w] = "conflict"
+  /\ phase' = [phase EXCEPT ![w] = IF Fault = "retry" THEN "send" ELSE "capture"]
+  /\ token' = [token EXCEPT ![w] = IF Fault = "retry" THEN rev ELSE @]
+  /\ wire' = [wire EXCEPT ![w] = "none"]
+  /\ retried' = retried \cup {w}
+  /\ UNCHANGED <<refs, rev, history, evidence, base, plan, uploaded, report, late, folded, noopok>>
+
+Timeout(w) ==
+  /\ phase[w] = "wait"
+  /\ phase' = [phase EXCEPT ![w] = "resolve"]
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, report, retried, late, folded, noopok>>
+
+Resolve(w) ==
+  /\ phase[w] = "resolve"
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] =
+       IF w \in evidence THEN "ok" ELSE IF Fault = "absence" THEN "ng" ELSE "unknown"]
+  /\ noopok' = IF HasNoop(w, plan[w])
+                    /\ (w \in evidence \/ Fault = "noopphantom")
+                 THEN noopok \cup {w} ELSE noopok
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded>>
+
+Crash(w) ==
+  /\ phase[w] # "done"
+  /\ phase' = [phase EXCEPT ![w] = "done"]
+  /\ report' = [report EXCEPT ![w] = "crashed"]
+  /\ noopok' = IF Fault = "noopphantom" /\ phase[w] # "capture"
+                    /\ HasNoop(w, plan[w])
+                 THEN noopok \cup {w} ELSE noopok
+  /\ UNCHANGED <<refs, rev, history, evidence, base, token, plan, uploaded, wire, retried, late, folded>>
+
+Fold ==
+  /\ evidence # {}
+  /\ folded' = folded \cup evidence /\ evidence' = {} /\ rev' = rev + 1
+  /\ UNCHANGED <<refs, history, phase, base, token, plan, uploaded, wire, report, retried, late, noopok>>
+
+Work(w) == Capture(w) \/ Reject(w) \/ Upload(w) \/ UploadFail(w) \/ Send(w)
+           \/ NoopSettle(w) \/ Reply(w) \/ Retry(w) \/ Resolve(w)
+Deliver(w) == Land(w) \/ Conflict(w)
+WorkNext == Fold \/ \E w \in Writers : Work(w) \/ Deliver(w) \/ Timeout(w) \/ Crash(w)
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+LiveSpec == Spec /\ \A w \in Writers : WF_vars(Work(w)) /\ WF_vars(Deliver(w))
+(* Healthy store/process arm: failures above may terminate everyone without a
+   winner, so termination alone is NOT global progress. Here upload failure
+   and process crash are absent; lost replies and finite contention remain. *)
+HealthyWork(w) == Capture(w) \/ Reject(w) \/ Upload(w) \/ Send(w)
+                  \/ NoopSettle(w) \/ Reply(w) \/ Retry(w) \/ Resolve(w)
+HealthyWorkNext == Fold \/ \E w \in Writers : HealthyWork(w) \/ Deliver(w) \/ Timeout(w)
+HealthyNext == HealthyWorkNext \/ UNCHANGED vars
+HealthySpec == Init /\ [][HealthyNext]_vars
+  /\ \A w \in Writers : WF_vars(HealthyWork(w)) /\ WF_vars(Deliver(w))
+
+Committed == {history[n].writer : n \in DOMAIN history}
+TypeOK ==
+  /\ refs \in [Refs -> 0..2] /\ rev \in 0..4 /\ Len(history) <= 2
+  /\ evidence \subseteq Writers /\ uploaded \subseteq Writers
+  /\ phase \in [Writers -> {"capture", "prepared", "send", "wait", "resolve", "done"}]
+  /\ base \in [Writers -> [Refs -> 0..2]] /\ token \in [Writers -> 0..4]
+  /\ wire \in [Writers -> {"none", "pending", "committed", "conflict"}]
+  /\ report \in [Writers -> {"none", "ok", "ng", "unknown", "crashed"}]
+  /\ retried \subseteq Writers /\ late \subseteq Writers /\ folded \subseteq Writers
+  /\ noopok \subseteq Writers
+  /\ \A w \in Writers : plan[w].state \in [Refs -> 0..2]
+       /\ plan[w].masks \in [1..Len(Batch(w)) -> SUBSET Refs]
+
+SubmissionAtomic ==
+  \A w \in Writers : \A n \in DOMAIN plan[w].masks :
+    plan[w].masks[n] \in {{}, Batch(w)[n].refs}
+DecisionIsolation ==
+  \A w \in Writers : plan[w] = Plan(w, base[w], "none")
+CommitPreconditions ==
+  \A n \in DOMAIN history :
+    LET h == history[n] IN h.masks = Plan(h.writer, h.before, "none").masks
+NoLostUpdate ==
+  \A n \in DOMAIN history :
+    LET h == history[n] IN h.after = Plan(h.writer, h.before, "none").state
+WriteAhead == \A n \in DOMAIN history : history[n].durable
+(* "ok" is receipt of the batch result, not an ok for every submitted ref.
+   The response's masks must name exactly the refs that actually committed;
+   invalid independent members report no successful refs (V1 regression). *)
+ReportedMasks(w) ==
+  IF Fault = "phantom" THEN [n \in 1..Len(Batch(w)) |-> Batch(w)[n].refs]
+  ELSE plan[w].masks
+ReportsTruthful ==
+  /\ \A w \in Writers : report[w] = "ok" /\ ~AllNoop(w, plan[w]) =>
+       \E n \in DOMAIN history : history[n].writer = w /\ history[n].masks = ReportedMasks(w)
+  /\ \A w \in Writers : report[w] = "ng" => w \notin Committed
+(* The batch seam: a no-op's ok receipt is lawful in exactly two worlds --
+   its whole batch was no-ops classified against this writer's own captured
+   refs (the early exit), or the batch whose overlay classified it actually
+   COMMITTED. A definitive ok for a no-op whose batchmate's write never
+   landed is a receipt for a world that never existed (the noopphantom
+   fault, i.e., failure paths special-casing no-op members as successes). *)
+NoopReceiptTruthful ==
+  \A w \in noopok : AllNoop(w, plan[w]) \/ w \in Committed
+AtMostOnce == Cardinality(Committed) = Len(history)
+Terminates == \A w \in Writers : <>(phase[w] = "done")
+EventuallyCommitted == <>(Committed # {})
+TransportSettles == \A w \in Writers : wire[w] = "pending" ~> wire[w] # "pending"
+
+(* Reachability probes: the runner expects each negated witness to FAIL.
+   These are existential schedule tests, not additional safety guarantees. *)
+NoRetryCommit == ~(Committed \cap retried # {})
+NoLateCommit == late = {}
+NoFoldedUnknown == ~\E w \in folded : report[w] = "unknown"
+NoAtomicCommit == ~\E n \in DOMAIN history :
+  \E m \in DOMAIN history[n].masks : Cardinality(history[n].masks[m]) = 2
+NoIsolatedCommit == ~\E n \in DOMAIN history :
+  history[n].writer = 1 /\ history[n].masks = <<{}, {"b"}>>
+NoDependentCommit == ~\E n \in DOMAIN history :
+  history[n].writer = 1 /\ history[n].masks = <<{"a"}, {"a"}>>
+\* The rider: a no-op ok'd together with its batchmate's committed write.
+NoNoopRide == ~\E w \in noopok : w \in Committed
+\* The early exit: a no-op ok'd with no commit anywhere in its history.
+NoQuietBatchNoop == ~\E w \in noopok : w \notin Committed
+\* The rejected+noop early exit: a no-op ok'd from a batch that also carried
+\* a rejected (empty-mask) member.
+NoRejectedNoopSettle == ~\E w \in noopok :
+  \E n \in DOMAIN plan[w].masks : plan[w].masks[n] = {}
+=============================================================================
diff --git a/docs/spec/scratch/CacheDiscipline.tla b/docs/spec/scratch/CacheDiscipline.tla
new file mode 100644
index 0000000..36404c8
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline.tla
@@ -0,0 +1,252 @@
+---------------------------- MODULE CacheDiscipline ----------------------------
+
+EXTENDS Naturals, TLC
+
+CONSTANTS TrustPresence, NoIdentity, SkipReprove, FailOpen, NoCancelCleanup,
+          SweepEntrySnap, SecondProcess, NoReaderRederive, NoRecheck
+
+MaxAttempt == 2
+MaxMver == 4
+MaxTear == 1
+LitterBound == 1
+
+Contents == {"absent", "valid", "torn", "garbage"}
+
+VARIABLES
+  inst,
+  cach,
+  linked,
+  live,
+  mver,
+  pub,
+  swp,
+  rdr,
+  tears,
+  litter,
+  cancelled,
+  viable,
+  blamed,
+  okevid,
+  swept
+vars == <<inst, cach, linked, live, mver, pub, swp, rdr, tears, litter,
+          cancelled, viable, blamed, okevid, swept>>
+
+SetInst(c) == inst' = c /\ cach' = (IF linked THEN c ELSE cach)
+SetCach(c) == cach' = c /\ inst' = (IF linked THEN c ELSE inst)
+
+IsEvidence(c) == c = "valid" \/ (NoIdentity /\ c = "torn")
+HaveEvidence == IsEvidence(inst) \/ IsEvidence(cach)
+
+RepairSatisfied == IF TrustPresence
+                   THEN inst # "absent" \/ cach # "absent"
+                   ELSE HaveEvidence
+
+Init ==
+  /\ inst = "absent" /\ cach = "absent" /\ linked = FALSE
+  /\ live = FALSE /\ mver = 0
+  /\ pub = [pc |-> "idle", mv |-> 0, attempt |-> 0, tcap |-> 0]
+  /\ swp = [pc |-> "idle", mv |-> 0, lv |-> FALSE]
+  /\ rdr = [pc |-> "idle", sawAbsent |-> FALSE]
+  /\ tears = 0 /\ litter = 0 /\ cancelled = FALSE
+  /\ viable = FALSE /\ blamed = FALSE /\ okevid = "absent" /\ swept = FALSE
+
+AddPack ==
+  /\ ~live /\ mver < MaxMver
+  /\ live' = TRUE /\ mver' = mver + 1
+  /\ UNCHANGED <<inst, cach, linked, pub, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+RetirePack ==
+  /\ live /\ mver < MaxMver
+  /\ live' = FALSE /\ mver' = mver + 1
+  /\ UNCHANGED <<inst, cach, linked, pub, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+Prefetch ==
+  /\ live /\ inst # "valid"
+  /\ inst' = "valid" /\ cach' = "valid" /\ linked' = TRUE
+  /\ UNCHANGED <<live, mver, pub, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+Tear ==
+  /\ tears < MaxTear
+  /\ \/ (inst # "absent" /\ SetInst("torn") /\ UNCHANGED linked)
+     \/ (inst # "absent" /\ SetInst("garbage") /\ UNCHANGED linked)
+     \/ (cach # "absent" /\ SetCach("torn") /\ UNCHANGED linked)
+     \/ (cach # "absent" /\ SetCach("garbage") /\ UNCHANGED linked)
+  /\ tears' = tears + 1
+  /\ UNCHANGED <<live, mver, pub, swp, rdr, litter, viable, blamed, okevid,
+                 swept, cancelled>>
+
+PStart ==
+  /\ pub.pc \in {"idle", "done", "refused"} /\ live
+  /\ pub.attempt < MaxAttempt
+  /\ pub' = [pub EXCEPT !.pc = "prove", !.mv = mver, !.attempt = @ + 1,
+                        !.tcap = tears]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+FirstOpen == IF inst \in {"valid", "torn"} THEN inst ELSE cach
+
+ProveStep(from) ==
+  /\ pub.pc = from
+  /\ IF HaveEvidence
+     THEN IF NoIdentity /\ FirstOpen = "torn"
+          THEN /\ pub' = [pub EXCEPT !.pc = "refused"]
+               /\ blamed' = TRUE
+               /\ UNCHANGED <<viable, okevid>>
+          ELSE /\ pub' = [pub EXCEPT !.pc = "cas"]
+               /\ okevid' = "valid"
+               /\ UNCHANGED <<viable, blamed>>
+     ELSE IF from = "prove"
+     THEN /\ pub' = [pub EXCEPT !.pc = "repair"]
+          /\ UNCHANGED <<viable, blamed, okevid>>
+     ELSE /\ pub' = [pub EXCEPT !.pc = "refuse"]
+          /\ UNCHANGED <<viable, blamed, okevid>>
+  /\ UNCHANGED <<inst, cach, linked, live, mver, swp, rdr, tears, litter,
+                 swept, cancelled>>
+
+PProve == ProveStep("prove")
+
+PRepairSkip ==
+  /\ pub.pc = "repair" /\ RepairSatisfied
+  /\ pub' = [pub EXCEPT !.pc = IF SkipReprove THEN "refuse" ELSE "reprove"]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+PRepairDownload ==
+  /\ pub.pc = "repair" /\ ~RepairSatisfied
+  /\ cach' = "valid" /\ linked' = FALSE /\ inst' = inst
+  /\ pub' = [pub EXCEPT !.pc = "reprove"]
+  /\ UNCHANGED <<live, mver, swp, rdr, tears, litter, viable, blamed, okevid,
+                 swept, cancelled>>
+
+PCancel ==
+  /\ pub.pc = "repair" /\ ~RepairSatisfied
+  /\ litter' = IF NoCancelCleanup THEN litter + 1 ELSE litter
+  /\ cancelled' = TRUE
+  /\ pub' = [pub EXCEPT !.pc = "refused"]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, swp, rdr, tears,
+                 viable, blamed, okevid, swept>>
+
+PReprove == ProveStep("reprove")
+
+PRefuse ==
+  /\ pub.pc = "refuse"
+  /\ LET restart == ~NoRecheck /\ pub.mv # mver IN
+     IF FailOpen
+     THEN /\ pub' = [pub EXCEPT !.pc = "cas"]
+          /\ okevid' = "absent"
+          /\ viable' = viable
+     ELSE IF restart
+     THEN /\ pub' = [pub EXCEPT !.pc = "idle"]
+          /\ viable' = viable /\ okevid' = okevid
+     ELSE
+
+          /\ pub' = [pub EXCEPT !.pc = "refused"]
+          /\ viable' = (viable \/ (pub.mv = mver /\ tears = pub.tcap))
+          /\ okevid' = okevid
+  /\ UNCHANGED <<inst, cach, linked, live, mver, swp, rdr, tears, litter,
+                 blamed, swept, cancelled>>
+
+PCas ==
+  /\ pub.pc = "cas"
+  /\ IF pub.mv = mver
+     THEN /\ mver' = mver + 1
+          /\ pub' = [pub EXCEPT !.pc = "done"]
+     ELSE /\ mver' = mver
+          /\ pub' = [pub EXCEPT !.pc = "idle"]
+  /\ UNCHANGED <<inst, cach, linked, live, swp, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+SweepCapture ==
+  /\ swp.pc = "idle"
+  /\ swp' = [swp EXCEPT !.pc = "armed", !.mv = mver, !.lv = live]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, pub, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+SweepUnlink ==
+  /\ swp.pc = "armed" /\ cach # "absent"
+  /\ LET deadByCapture == ~swp.lv
+         deadNow == ~live
+         authority == IF SweepEntrySnap \/ SecondProcess
+                      THEN deadByCapture ELSE deadNow
+     IN /\ authority
+        /\ cach' = "absent" /\ linked' = FALSE /\ inst' = inst
+  /\ swp' = [swp EXCEPT !.pc = "idle"]
+  /\ swept' = TRUE
+  /\ UNCHANGED <<live, mver, pub, rdr, tears, litter, cancelled, viable, blamed,
+                 okevid>>
+
+SweepDisarm ==
+  /\ swp.pc = "armed"
+  /\ swp' = [swp EXCEPT !.pc = "idle"]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, pub, rdr, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+RProbe ==
+  /\ rdr.pc = "idle" /\ live
+  /\ rdr' = [rdr EXCEPT !.pc = "load", !.sawAbsent = (cach = "absent")]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, pub, swp, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+RLoad ==
+  /\ rdr.pc = "load"
+  /\ IF rdr.sawAbsent /\ cach = "absent"
+     THEN /\ cach' = "valid" /\ linked' = FALSE /\ inst' = inst
+          /\ rdr' = [rdr EXCEPT !.pc = "serving"]
+     ELSE IF cach \in {"valid", "torn"}
+     THEN /\ rdr' = [rdr EXCEPT !.pc = "serving"]
+          /\ UNCHANGED <<inst, cach, linked>>
+     ELSE IF NoReaderRederive
+     THEN /\ rdr' = [rdr EXCEPT !.pc = "failed"]
+          /\ UNCHANGED <<inst, cach, linked>>
+     ELSE
+          /\ cach' = "valid" /\ linked' = FALSE /\ inst' = inst
+          /\ rdr' = [rdr EXCEPT !.pc = "serving"]
+  /\ UNCHANGED <<live, mver, pub, swp, tears, litter, viable, blamed, okevid,
+                 swept, cancelled>>
+
+RDone ==
+  /\ rdr.pc \in {"serving", "failed"}
+  /\ rdr' = [rdr EXCEPT !.pc = "idle", !.sawAbsent = FALSE]
+  /\ UNCHANGED <<inst, cach, linked, live, mver, pub, swp, tears, litter,
+                 viable, blamed, okevid, swept, cancelled>>
+
+WorkNext ==
+  \/ AddPack \/ RetirePack \/ Prefetch \/ Tear
+  \/ PStart \/ PProve \/ PRepairSkip \/ PRepairDownload \/ PCancel
+  \/ PReprove \/ PRefuse \/ PCas
+  \/ SweepCapture \/ SweepUnlink \/ SweepDisarm
+  \/ RProbe \/ RLoad \/ RDone
+
+Next == WorkNext \/ UNCHANGED vars
+
+Spec == Init /\ [][Next]_vars
+
+TypeOK ==
+  /\ inst \in Contents /\ cach \in Contents /\ linked \in BOOLEAN
+  /\ (linked => inst = cach)
+  /\ live \in BOOLEAN /\ mver \in 0..(MaxMver + MaxAttempt + 1)
+  /\ pub.pc \in {"idle", "prove", "repair", "reprove", "refuse", "cas",
+                 "done", "refused"}
+  /\ litter \in 0..MaxAttempt
+
+NoFalseCovered == pub.pc \in {"cas", "done"} => okevid = "valid"
+
+ClassificationHonest == ~blamed
+
+NoViableVictim == ~viable
+
+BoundedLitter == litter <= LitterBound
+
+ReaderCompletes == rdr.pc # "failed"
+
+NoPrefetchRescue ==
+  ~(pub.pc = "done" /\ linked)
+
+NoSweepDuringRepair ==
+  ~(swept /\ pub.pc \in {"repair", "reprove"})
+
+NoCancelRecovery == ~(cancelled /\ pub.pc = "done")
+=================================================================================
diff --git a/docs/spec/scratch/CacheDiscipline_fail_open.cfg b/docs/spec/scratch/CacheDiscipline_fail_open.cfg
new file mode 100644
index 0000000..77d0fab
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_fail_open.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = TRUE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoFalseCovered
diff --git a/docs/spec/scratch/CacheDiscipline_fixed.cfg b/docs/spec/scratch/CacheDiscipline_fixed.cfg
new file mode 100644
index 0000000..141ce5b
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_fixed.cfg
@@ -0,0 +1,17 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoFalseCovered
+INVARIANT ClassificationHonest
+INVARIANT NoViableVictim
+INVARIANT BoundedLitter
+INVARIANT ReaderCompletes
diff --git a/docs/spec/scratch/CacheDiscipline_no_cancel_cleanup.cfg b/docs/spec/scratch/CacheDiscipline_no_cancel_cleanup.cfg
new file mode 100644
index 0000000..66ae87b
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_no_cancel_cleanup.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = TRUE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT BoundedLitter
diff --git a/docs/spec/scratch/CacheDiscipline_no_identity.cfg b/docs/spec/scratch/CacheDiscipline_no_identity.cfg
new file mode 100644
index 0000000..4e3e900
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_no_identity.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = TRUE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT ClassificationHonest
diff --git a/docs/spec/scratch/CacheDiscipline_no_occupancy.cfg b/docs/spec/scratch/CacheDiscipline_no_occupancy.cfg
new file mode 100644
index 0000000..4d34bfa
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_no_occupancy.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = TRUE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoViableVictim
diff --git a/docs/spec/scratch/CacheDiscipline_reader_uac.cfg b/docs/spec/scratch/CacheDiscipline_reader_uac.cfg
new file mode 100644
index 0000000..1c1f800
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_reader_uac.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = TRUE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT ReaderCompletes
diff --git a/docs/spec/scratch/CacheDiscipline_skip_reprove.cfg b/docs/spec/scratch/CacheDiscipline_skip_reprove.cfg
new file mode 100644
index 0000000..0c262c4
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_skip_reprove.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = TRUE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoViableVictim
diff --git a/docs/spec/scratch/CacheDiscipline_sweep_entry.cfg b/docs/spec/scratch/CacheDiscipline_sweep_entry.cfg
new file mode 100644
index 0000000..7962ad9
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_sweep_entry.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = TRUE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoViableVictim
diff --git a/docs/spec/scratch/CacheDiscipline_trust_presence.cfg b/docs/spec/scratch/CacheDiscipline_trust_presence.cfg
new file mode 100644
index 0000000..b81fb0b
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_trust_presence.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = TRUE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoViableVictim
diff --git a/docs/spec/scratch/CacheDiscipline_w_cancel.cfg b/docs/spec/scratch/CacheDiscipline_w_cancel.cfg
new file mode 100644
index 0000000..fffea32
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_w_cancel.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoCancelRecovery
diff --git a/docs/spec/scratch/CacheDiscipline_w_prefetch.cfg b/docs/spec/scratch/CacheDiscipline_w_prefetch.cfg
new file mode 100644
index 0000000..3fd3880
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_w_prefetch.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoPrefetchRescue
diff --git a/docs/spec/scratch/CacheDiscipline_w_sweep.cfg b/docs/spec/scratch/CacheDiscipline_w_sweep.cfg
new file mode 100644
index 0000000..7cfb897
--- /dev/null
+++ b/docs/spec/scratch/CacheDiscipline_w_sweep.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    TrustPresence = FALSE
+    NoIdentity = FALSE
+    SkipReprove = FALSE
+    FailOpen = FALSE
+    NoCancelCleanup = FALSE
+    SweepEntrySnap = FALSE
+    SecondProcess = FALSE
+    NoReaderRederive = FALSE
+    NoRecheck = FALSE
+INVARIANT TypeOK
+INVARIANT NoSweepDuringRepair
diff --git a/docs/spec/scratch/ClosureProvenance.tla b/docs/spec/scratch/ClosureProvenance.tla
new file mode 100644
index 0000000..9a3e833
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance.tla
@@ -0,0 +1,167 @@
+------------------------- MODULE ClosureProvenance -------------------------
+(* C6a: candidate boundary and current tips must be covered at every CAS.
+   A hypothetical pruning replacement tests the dual seal obligation. Public
+   maintenance conserves indexed objects; pruning is not a supported mode.
+   The model is a bounded counterexample laboratory, not a Rust refinement
+   proof. Each fault and witness is listed in tlc/cases.tsv. *)
+EXTENDS Naturals
+
+CONSTANTS PGuard, MGuard, TipGuard, StaleRetry, Cutters, PlanInputsLive
+
+Objs == {"B0", "X", "Y", "C"}
+Parent == [o \in Objs |-> CASE o = "B0" -> {}
+                            [] o = "X"  -> {"B0"}
+                            [] o = "Y"  -> {"B0"}
+                            [] o = "C"  -> {"X"}]
+
+ClosureOf == [o \in Objs |-> CASE o = "B0" -> {"B0"}
+                               [] o = "X"  -> {"X", "B0"}
+                               [] o = "Y"  -> {"Y", "B0"}
+                               [] o = "C"  -> {"C", "X", "B0"}]
+
+Packs == {"KBase", "KX", "KY", "PC", "KP"}
+Holds == [p \in Packs |-> CASE p = "KBase" -> {"B0"}
+                            [] p = "KX"    -> {"X"}
+                            [] p = "KY"    -> {"Y"}
+                            [] p = "PC"    -> {"C"}
+                            [] p = "KP"    -> {"B0", "Y"}]
+Objects(ps) == UNION {Holds[p] : p \in ps}
+
+ExtRefs(p) == (UNION {Parent[o] : o \in Holds[p]}) \ Holds[p]
+
+VARIABLES
+  live,      
+  disk,      
+  refA,      
+  refB,      
+  gen,       
+  pphase,    
+  pcap,      
+  pevid,     
+  retried,   
+  plan,      
+  planSup,   
+  replanned, 
+  undercut   
+vars == <<live, disk, refA, refB, gen, pphase, pcap, pevid, retried,
+          plan, planSup, replanned, undercut>>
+
+RefOids == {refA} \cup (IF refB = "unset" THEN {} ELSE {refB})
+ReachableFromRefs == UNION {ClosureOf[o] : o \in RefOids}
+MemberNow == ExtRefs("PC") \subseteq Objects(live \cup {"PC"})
+
+Init == /\ live = {"KBase", "KX"} /\ disk = {"KBase", "KX"}
+        /\ refA = "X" /\ refB = "unset" /\ gen = 0
+        /\ pphase = "idle" /\ pcap = 0 /\ pevid = "unset" /\ retried = FALSE
+        /\ plan = [c \in Cutters |-> "none"] /\ planSup = [c \in Cutters |-> {}]
+        /\ replanned = FALSE /\ undercut = FALSE
+
+Validate ==
+  /\ pphase = "idle"
+  /\ LET readable == ExtRefs("PC") \subseteq Objects(disk \cup {"PC"})
+     IN /\ pphase' = IF readable /\ (PGuard # "validate" \/ MemberNow)
+                     THEN "ready" ELSE "refused"
+        /\ pevid' = IF PGuard = "attempt" THEN "unset" ELSE "ok"
+  /\ UNCHANGED <<live, disk, refA, refB, gen, pcap, retried,
+                 plan, planSup, replanned, undercut>>
+
+Arm ==
+  /\ pphase \in {"ready", "lost"}
+  /\ pcap' = gen
+  /\ pevid' = IF PGuard = "attempt" /\ ~(StaleRetry /\ pphase = "lost")
+              THEN (IF MemberNow THEN "ok" ELSE "bad")
+              ELSE pevid
+  /\ pphase' = "armed"
+  /\ UNCHANGED <<live, disk, refA, refB, gen, retried,
+                 plan, planSup, replanned, undercut>>
+
+FireCAS ==
+  /\ pphase = "armed"
+  /\ IF gen # pcap
+     THEN /\ pphase' = "lost" /\ retried' = TRUE
+          /\ UNCHANGED <<live, disk, refA, refB, gen, pcap, pevid,
+                         plan, planSup, replanned, undercut>>
+     ELSE IF pevid = "bad" \/ refB # "unset"
+     THEN /\ pphase' = "refused"
+          /\ UNCHANGED <<live, disk, refA, refB, gen, pcap, pevid, retried,
+                         plan, planSup, replanned, undercut>>
+     ELSE /\ pphase' = "done"
+          /\ live' = live \cup {"PC"} /\ disk' = disk \cup {"PC"}
+          /\ refB' = "C" /\ gen' = gen + 1
+          /\ UNCHANGED <<refA, pcap, pevid, retried, plan, planSup, replanned, undercut>>
+
+ForcePush ==
+  /\ refA = "X"
+  /\ refA' = "Y" /\ live' = live \cup {"KY"} /\ disk' = disk \cup {"KY"}
+  /\ gen' = gen + 1
+  /\ UNCHANGED <<refB, pphase, pcap, pevid, retried, plan, planSup, replanned, undercut>>
+
+RevivePush ==
+  /\ refB = "unset"
+  /\ TipGuard => "X" \in Objects(live)
+  /\ refB' = "X" /\ gen' = gen + 1
+  /\ UNCHANGED <<live, disk, refA, pphase, pcap, pevid, retried,
+                 plan, planSup, replanned, undercut>>
+
+PlanPrune(c) ==
+  /\ plan[c] = "none" /\ "KX" \in live /\ "X" \notin ReachableFromRefs
+  /\ plan' = [plan EXCEPT ![c] = "ready"]
+  /\ planSup' = [planSup EXCEPT ![c] = live]
+  /\ UNCHANGED <<live, disk, refA, refB, gen, pphase, pcap, pevid, retried,
+                 replanned, undercut>>
+
+SealPrune(c) ==
+  /\ plan[c] = "ready"
+  /\ LET result == (live \ planSup[c]) \cup {"KP"}
+         
+         
+         
+         inputsLive == planSup[c] \subseteq live
+         closedNow == \A o \in RefOids : ClosureOf[o] \subseteq Objects(result)
+         commits == /\ (PlanInputsLive => inputsLive)
+                    /\ (MGuard = "stale" \/ closedNow)
+     IN /\ undercut' = (undercut \/ ~inputsLive)
+        /\ plan' = [plan EXCEPT ![c] = "none"]
+        /\ planSup' = [planSup EXCEPT ![c] = {}]
+        /\ IF commits
+           THEN /\ live' = result /\ disk' = disk \cup {"KP"}
+                /\ gen' = gen + 1
+                /\ UNCHANGED <<refA, refB, pphase, pcap, pevid, retried, replanned>>
+           ELSE /\ replanned' = TRUE
+                /\ UNCHANGED <<live, disk, refA, refB, gen, pphase, pcap, pevid,
+                               retried>>
+
+LocalDelete ==
+  /\ "KX" \in disk /\ "KX" \notin live
+  /\ disk' = disk \ {"KX"}
+  /\ UNCHANGED <<live, refA, refB, gen, pphase, pcap, pevid, retried,
+                 plan, planSup, replanned, undercut>>
+
+WorkNext == Validate \/ Arm \/ FireCAS \/ ForcePush \/ RevivePush \/ LocalDelete
+        \/ \E c \in Cutters : PlanPrune(c) \/ SealPrune(c)
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+TypeOK == /\ live \subseteq Packs /\ disk \subseteq Packs
+          /\ refA \in {"X", "Y"} /\ refB \in {"unset", "C", "X"}
+          /\ gen \in 0..5 /\ pcap \in 0..5
+          /\ pphase \in {"idle", "ready", "armed", "lost", "done", "refused"}
+          /\ pevid \in {"unset", "ok", "bad"}
+          /\ retried \in BOOLEAN /\ replanned \in BOOLEAN
+          /\ plan \in [Cutters -> {"none", "ready"}]
+          /\ planSup \in [Cutters -> SUBSET Packs]
+          /\ undercut \in BOOLEAN
+
+ServableClosure == \A o \in RefOids : ClosureOf[o] \subseteq Objects(live)
+
+LiveClosed == \A o \in Objects(live) : Parent[o] \subseteq Objects(live)
+
+NoRefusal     == pphase # "refused"
+NoCommit      == pphase # "done"
+NoRetryCommit == ~(retried /\ pphase = "done")
+NoReplan      == ~replanned
+
+NoUndercut    == ~undercut
+=============================================================================
diff --git a/docs/spec/scratch/ClosureProvenance_bug.cfg b/docs/spec/scratch/ClosureProvenance_bug.cfg
new file mode 100644
index 0000000..276ffcb
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_bug.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "none"
+    MGuard = "attempt"
+    TipGuard = TRUE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT ServableClosure
diff --git a/docs/spec/scratch/ClosureProvenance_fix.cfg b/docs/spec/scratch/ClosureProvenance_fix.cfg
new file mode 100644
index 0000000..a8153f5
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_fix.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "attempt"
+    MGuard = "attempt"
+    TipGuard = TRUE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT TypeOK
+INVARIANT ServableClosure
+INVARIANT LiveClosed
diff --git a/docs/spec/scratch/ClosureProvenance_no_tip.cfg b/docs/spec/scratch/ClosureProvenance_no_tip.cfg
new file mode 100644
index 0000000..0cdd253
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_no_tip.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "attempt"
+    MGuard = "attempt"
+    TipGuard = FALSE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT ServableClosure
diff --git a/docs/spec/scratch/ClosureProvenance_rival.cfg b/docs/spec/scratch/ClosureProvenance_rival.cfg
new file mode 100644
index 0000000..c0377f9
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_rival.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "attempt"
+    MGuard = "attempt"
+    TipGuard = TRUE
+    Cutters = {1,2}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT TypeOK
+INVARIANT ServableClosure
+INVARIANT LiveClosed
diff --git a/docs/spec/scratch/ClosureProvenance_stale.cfg b/docs/spec/scratch/ClosureProvenance_stale.cfg
new file mode 100644
index 0000000..4c37413
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_stale.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "validate"
+    MGuard = "attempt"
+    TipGuard = TRUE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT ServableClosure
diff --git a/docs/spec/scratch/ClosureProvenance_stale_retry.cfg b/docs/spec/scratch/ClosureProvenance_stale_retry.cfg
new file mode 100644
index 0000000..aeec149
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_stale_retry.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "attempt"
+    MGuard = "attempt"
+    TipGuard = TRUE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = TRUE
+INVARIANT ServableClosure
diff --git a/docs/spec/scratch/ClosureProvenance_stale_seal.cfg b/docs/spec/scratch/ClosureProvenance_stale_seal.cfg
new file mode 100644
index 0000000..8c4c23e
--- /dev/null
+++ b/docs/spec/scratch/ClosureProvenance_stale_seal.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+    PGuard = "attempt"
+    MGuard = "stale"
+    TipGuard = TRUE
+    Cutters = {1}
+    PlanInputsLive = TRUE
+    StaleRetry = FALSE
+INVARIANT ServableClosure
diff --git a/docs/spec/scratch/FrontReplay.tla b/docs/spec/scratch/FrontReplay.tla
new file mode 100644
index 0000000..404b202
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay.tla
@@ -0,0 +1,244 @@
+------------------------------- MODULE FrontReplay -------------------------------
+(* C9: at-least-once transport is harmless. A front forwards receive-pack to   *)
+(* the push broker and may retry the buffered body locally ONLY when it knows  *)
+(* no HTTP connection was established; once delivery may have started, no      *)
+(* local replay at any size (smart.rs, forward.rs).                      *)
+(*                                                                             *)
+(* The row's falsifier says "a duplicated POST double-applies", and the        *)
+(* protocol stands on two independent legs this fragment separates:           *)
+(*   1. The old-oid precondition, re-verified at every application, makes a   *)
+(*      STATE-CHANGING duplicate REJECTED rather than re-applied (within the  *)
+(*      contract's ABA exclusion). But a FIXED-POINT submission               *)
+(*      (old = new = current) satisfies its own precondition forever: only    *)
+(*      the publisher's no-op guard (a submission that changes nothing        *)
+(*      publishes nothing) stops each redelivery from committing a fresh WAL  *)
+(*      entry -- log growth and duplicate events with zero state change.      *)
+(*      NoOpPublishes removes that guard.                                                     *)
+(*   2. The front's Fallback/Indeterminate rule carries the RECEIPT. A        *)
+(*      replayed ambiguous delivery can lose to its own late-landing          *)
+(*      original: the client then holds a definite "rejected" while the push  *)
+(*      applied. The rule never converts ambiguity into certainty -- after   *)
+(*      an ambiguous delivery the client hears "outcome unknown", and a lost  *)
+(*      reply IS ambiguity the client observed (its connection died without   *)
+(*      an authoritative report). Commit and reply are separate steps here    *)
+(*      for exactly that reason.                                              *)
+(*                                                                             *)
+(* Fallback fires on two signals: identity token unavailable (no connection   *)
+(* attempted) and reqwest is_connect() (no connection established). The       *)
+(* second is an ENVIRONMENT AXIOM borrowed from a client library's error      *)
+(* taxonomy. ConnectSignalLies breaks exactly that axiom -- the classified-   *)
+(* dead delivery lands inside the error-to-replay window -- and is the arm    *)
+(* that proves the taxonomy is load-bearing for the receipt.                  *)
+(*                                                                             *)
+(* Kept out on purpose: broker-side CAS ambiguity and slot churn              *)
+(* (LogSlotClaim, BatchPublication own them -- application here is one        *)
+(* atomic precondition-checked step); ABA return-to-old (contract §4          *)
+(* excludes it; values are monotone); bodies above the replay buffer (they    *)
+(* cannot replay by construction: the 503 is the ambiguous shape minus the    *)
+(* pending delivery); multi-front concurrency on DISTINCT submissions         *)
+(* (ordinary CAS contention, modeled elsewhere).                              *)
+
+EXTENDS Naturals
+
+CONSTANTS ReplayOnAmbiguous,   \* mutation: replay the buffered body after an
+                               \* ambiguous send instead of answering unknown
+          ConnectSignalLies,   \* mutation: a delivery classified connect-fail
+                               \* was actually delivered and lands late
+          NoReplayPrecondition,\* mutation: the local replay path applies
+                               \* without re-checking the declared old value
+          NoOpPublishes        \* mutation: the publisher commits a WAL entry
+                               \* for a submission that changes nothing
+
+MaxTries == 3
+
+V0 == 0
+V1 == 1
+
+VARIABLES
+  ref,        \* the served ref value
+  sub,        \* the submission in flight: "change" (V0 -> V1) then, after a
+              \* clean success, "noop" (V1 -> V1, the fixed point)
+  applied,    \* ghost: state-changing applications of the CURRENT submission
+  entries,    \* ghost: WAL entries committed for the CURRENT submission
+  cpc,        \* client: "send" | "ok" | "ng" | "unknown"
+  fpc,        \* front: "idle" | "replay" -- a decided local replay not yet
+              \* executed; the window every laundering trace needs
+  rpend,      \* a committed-but-undelivered report: "none" | "ok" | "ng"
+  tries,      \* client attempts consumed for the current submission
+  sawUnknown, \* ghost: the client observed ambiguity at least once -- an
+              \* explicit "outcome unknown" OR a reply that never arrived
+  replayed,   \* ghost: a local fallback replay committed (witness anchor)
+  pending     \* a sent-but-unacknowledged delivery: "none" | "inflight"
+
+vars == <<ref, sub, applied, entries, cpc, fpc, rpend, tries, sawUnknown,
+          replayed, pending>>
+
+Init ==
+  /\ ref = V0 /\ sub = "change" /\ applied = 0 /\ entries = 0
+  /\ cpc = "send" /\ fpc = "idle" /\ rpend = "none" /\ tries = 0
+  /\ sawUnknown = FALSE /\ replayed = FALSE /\ pending = "none"
+
+------------------------------------------------------------------------------
+(* One application against the WAL. The precondition (C3, per attempt): the   *)
+(* declared old value must equal the current ref. A change both passes and    *)
+(* then falsifies it; a fixed point passes it forever -- which is why the     *)
+(* publisher's no-op guard, not the precondition, is what keeps a duplicated  *)
+(* no-op from committing entries.                                             *)
+
+PrecondHolds == IF sub = "change" THEN ref = V0 ELSE ref = V1
+
+\* TRUE when this application commits a WAL entry: a change always does; a
+\* fixed point only under the removed guard.
+Commits == IF sub = "change" THEN TRUE ELSE NoOpPublishes
+
+Apply(ok, notOk) ==
+  IF PrecondHolds
+    THEN /\ ref' = IF sub = "change" THEN V1 ELSE ref
+         /\ applied' = IF sub = "change" THEN applied + 1 ELSE applied
+         /\ entries' = IF Commits THEN entries + 1 ELSE entries
+         /\ rpend' = ok
+    ELSE /\ rpend' = notOk /\ UNCHANGED <<ref, applied, entries>>
+
+------------------------------------------------------------------------------
+(* Client attempt: the front forwards, the environment picks the fate.        *)
+
+\* Clean forward: the broker receives and applies; the report is now pending
+\* delivery -- commit and reply are DIFFERENT steps, and the reply can be
+\* lost after the commit.
+ForwardResponds ==
+  /\ cpc = "send" /\ fpc = "idle" /\ rpend = "none" /\ tries < MaxTries
+  /\ tries' = tries + 1
+  /\ Apply("ok", "ng")
+  /\ UNCHANGED <<sub, cpc, fpc, sawUnknown, replayed, pending>>
+
+\* Connect-classified failure: the axiom says nothing reached the broker, so
+\* the front decides to replay the buffered body locally; the replay executes
+\* later. ConnectSignalLies breaks the axiom: the classified-dead delivery is
+\* in flight and may land inside that window.
+ForwardConnectFail ==
+  /\ cpc = "send" /\ fpc = "idle" /\ rpend = "none" /\ tries < MaxTries
+  /\ tries' = tries + 1
+  /\ pending' = IF ConnectSignalLies THEN "inflight" ELSE pending
+  /\ fpc' = "replay"
+  /\ UNCHANGED <<ref, sub, applied, entries, cpc, rpend, sawUnknown, replayed>>
+
+\* Ambiguous send: delivery may have started. The fixed front answers
+\* "outcome unknown" and replays nothing; the bytes stay in flight.
+\* ReplayOnAmbiguous schedules a local replay instead -- laundering.
+ForwardAmbiguous ==
+  /\ cpc = "send" /\ fpc = "idle" /\ rpend = "none" /\ tries < MaxTries
+  /\ tries' = tries + 1
+  /\ pending' = "inflight"
+  /\ IF ReplayOnAmbiguous
+       THEN /\ fpc' = "replay" /\ UNCHANGED <<cpc, sawUnknown>>
+       ELSE /\ cpc' = "unknown" /\ sawUnknown' = TRUE /\ UNCHANGED fpc
+  /\ UNCHANGED <<ref, sub, applied, entries, rpend, replayed>>
+
+\* The decided local replay commits through the same per-attempt
+\* precondition every publication uses -- unless NoReplayPrecondition strips
+\* it -- and leaves its report pending delivery.
+ReplayCommit ==
+  /\ fpc = "replay" /\ rpend = "none"
+  /\ fpc' = "idle" /\ replayed' = TRUE
+  /\ IF PrecondHolds \/ NoReplayPrecondition
+       THEN /\ ref' = IF sub = "change" THEN V1 ELSE ref
+            /\ applied' = IF sub = "change" THEN applied + 1 ELSE applied
+            /\ entries' = IF Commits \/ NoReplayPrecondition
+                            THEN entries + 1 ELSE entries
+            /\ rpend' = "ok"
+       ELSE /\ rpend' = "ng" /\ UNCHANGED <<ref, applied, entries>>
+  /\ UNCHANGED <<sub, cpc, tries, sawUnknown, pending>>
+
+\* The pending report reaches the client...
+DeliverReply ==
+  /\ rpend # "none"
+  /\ cpc' = rpend /\ rpend' = "none"
+  /\ UNCHANGED <<ref, sub, applied, entries, fpc, tries, sawUnknown,
+                 replayed, pending>>
+
+\* ...or never does: the front crashed or the connection died after the
+\* commit. The client observed ambiguity -- no authoritative report exists
+\* on its side of the wire -- which is exactly what sawUnknown means.
+LoseReply ==
+  /\ rpend # "none"
+  /\ cpc' = "unknown" /\ rpend' = "none" /\ sawUnknown' = TRUE
+  /\ UNCHANGED <<ref, sub, applied, entries, fpc, tries, replayed, pending>>
+
+\* An ambiguous or lied-about delivery lands: same precondition, and its
+\* response reaches no one.
+LateDelivery ==
+  /\ pending = "inflight"
+  /\ pending' = "none"
+  /\ IF PrecondHolds
+       THEN /\ ref' = IF sub = "change" THEN V1 ELSE ref
+            /\ applied' = IF sub = "change" THEN applied + 1 ELSE applied
+            /\ entries' = IF Commits THEN entries + 1 ELSE entries
+       ELSE UNCHANGED <<ref, applied, entries>>
+  /\ UNCHANGED <<sub, cpc, fpc, rpend, tries, sawUnknown, replayed>>
+
+\* After ambiguity the client retries the same submission -- the
+\* at-least-once source the protocol invites by design.
+ClientRetry ==
+  /\ cpc = "unknown" /\ tries < MaxTries
+  /\ cpc' = "send"
+  /\ UNCHANGED <<ref, sub, applied, entries, fpc, rpend, tries, sawUnknown,
+                 replayed, pending>>
+
+\* After a clean success the client pushes the fixed point: the same ref at
+\* the value it already holds (old = new = current). Ghost counters reset --
+\* the invariants are per submission.
+StartNoOp ==
+  /\ sub = "change" /\ cpc = "ok" /\ pending = "none" /\ rpend = "none"
+  /\ sub' = "noop" /\ cpc' = "send" /\ tries' = 0
+  /\ applied' = 0 /\ entries' = 0 /\ rpend' = "none"
+  /\ UNCHANGED <<ref, fpc, sawUnknown, replayed, pending>>
+
+WorkNext == ForwardResponds \/ ForwardConnectFail \/ ForwardAmbiguous
+        \/ ReplayCommit \/ DeliverReply \/ LoseReply
+        \/ LateDelivery \/ ClientRetry \/ StartNoOp
+
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+------------------------------------------------------------------------------
+TypeOK ==
+  /\ ref \in {V0, V1} /\ sub \in {"change", "noop"}
+  /\ applied \in 0..2 /\ entries \in 0..3 /\ tries \in 0..MaxTries
+  /\ cpc \in {"send", "ok", "ng", "unknown"}
+  /\ fpc \in {"idle", "replay"} /\ rpend \in {"none", "ok", "ng"}
+  /\ pending \in {"none", "inflight"}
+
+\* Leg 1a: the current submission changes state at most once, whatever the
+\* transport does. Carried by the precondition alone.
+AtMostOnce == applied <= 1
+
+\* Leg 1b: the current submission commits at most one WAL entry, however
+\* many times it is delivered. For a fixed point the precondition is
+\* powerless -- only the publisher's no-op guard keeps this true.
+AtMostOneEntry == entries <= 1
+
+\* A definite success on a state-changing submission is truthful. (A no-op's
+\* ok is the expected report for publishing nothing.)
+OkTruthful == (cpc = "ok" /\ sub = "change") => applied >= 1
+
+\* Leg 2, the sharp one: a definite REJECTION while the submission applied
+\* is lawful only after the client observed ambiguity -- an explicit
+\* "outcome unknown" or a reply that never arrived. On any path where every
+\* answer was definite, ng means not applied.
+NoLaunderedRejection ==
+  (cpc = "ng" /\ sub = "change" /\ applied >= 1) => sawUnknown
+
+\* Witnesses (negated; each must FAIL in the fix arm): a local fallback
+\* replay lawfully applies; recovery to applied-exactly-once after
+\* ambiguity; a duplicate rejected by the precondition; the honest
+\* ng-while-applied behind observed ambiguity (NoLaunderedRejection is not
+\* vacuous); a no-op that reports ok while publishing nothing.
+NoFallbackApply == ~(cpc = "ok" /\ applied = 1 /\ replayed)
+NoAmbiguousRecovery == ~(sawUnknown /\ cpc = "ok" /\ applied = 1)
+NoDuplicateRejected == ~(sub = "change" /\ applied = 1 /\ cpc = "ng")
+NoHonestConfusion ==
+  ~(sub = "change" /\ cpc = "ng" /\ applied = 1 /\ sawUnknown)
+NoQuietNoOp == ~(sub = "noop" /\ cpc = "ok" /\ entries = 0)
+==================================================================================
diff --git a/docs/spec/scratch/FrontReplay_connect_lies.cfg b/docs/spec/scratch/FrontReplay_connect_lies.cfg
new file mode 100644
index 0000000..4b31eb1
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay_connect_lies.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    ReplayOnAmbiguous = FALSE
+    ConnectSignalLies = TRUE
+    NoReplayPrecondition = FALSE
+    NoOpPublishes = FALSE
+INVARIANT TypeOK
+INVARIANT AtMostOnce
+INVARIANT OkTruthful
+INVARIANT NoLaunderedRejection
+INVARIANT AtMostOneEntry
diff --git a/docs/spec/scratch/FrontReplay_fix.cfg b/docs/spec/scratch/FrontReplay_fix.cfg
new file mode 100644
index 0000000..8302d51
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay_fix.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    ReplayOnAmbiguous = FALSE
+    ConnectSignalLies = FALSE
+    NoReplayPrecondition = FALSE
+    NoOpPublishes = FALSE
+INVARIANT TypeOK
+INVARIANT AtMostOnce
+INVARIANT OkTruthful
+INVARIANT NoLaunderedRejection
+INVARIANT AtMostOneEntry
diff --git a/docs/spec/scratch/FrontReplay_no_precondition.cfg b/docs/spec/scratch/FrontReplay_no_precondition.cfg
new file mode 100644
index 0000000..e992812
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay_no_precondition.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    ReplayOnAmbiguous = FALSE
+    ConnectSignalLies = FALSE
+    NoReplayPrecondition = TRUE
+    NoOpPublishes = FALSE
+INVARIANT TypeOK
+INVARIANT AtMostOnce
+INVARIANT OkTruthful
+INVARIANT NoLaunderedRejection
+INVARIANT AtMostOneEntry
diff --git a/docs/spec/scratch/FrontReplay_noop_publishes.cfg b/docs/spec/scratch/FrontReplay_noop_publishes.cfg
new file mode 100644
index 0000000..6898ddc
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay_noop_publishes.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    ReplayOnAmbiguous = FALSE
+    ConnectSignalLies = FALSE
+    NoReplayPrecondition = FALSE
+    NoOpPublishes = TRUE
+INVARIANT TypeOK
+INVARIANT AtMostOnce
+INVARIANT OkTruthful
+INVARIANT NoLaunderedRejection
+INVARIANT AtMostOneEntry
diff --git a/docs/spec/scratch/FrontReplay_replay_ambiguous.cfg b/docs/spec/scratch/FrontReplay_replay_ambiguous.cfg
new file mode 100644
index 0000000..aebc174
--- /dev/null
+++ b/docs/spec/scratch/FrontReplay_replay_ambiguous.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    ReplayOnAmbiguous = TRUE
+    ConnectSignalLies = FALSE
+    NoReplayPrecondition = FALSE
+    NoOpPublishes = FALSE
+INVARIANT TypeOK
+INVARIANT AtMostOnce
+INVARIANT OkTruthful
+INVARIANT NoLaunderedRejection
+INVARIANT AtMostOneEntry
diff --git a/docs/spec/scratch/LogSlotClaim.tla b/docs/spec/scratch/LogSlotClaim.tla
new file mode 100644
index 0000000..2453f8f
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim.tla
@@ -0,0 +1,248 @@
+------------------------------ MODULE LogSlotClaim ------------------------------
+(* The log-slot claim protocol: who may delete a log segment, when, and what   *)
+(* bytes a committed manifest's descriptor actually resolves to                *)
+(* (publish.rs: claim_log_slot / sweep_burned / drop_own_slot / cas_landed).   *)
+(*                                                                             *)
+(* Every publication claims `log/<seq>.pb` by exclusive create BEFORE its      *)
+(* manifest CAS. Contenders finding an occupied seq with an unmoved head       *)
+(* declare an orphan after a grace and BURN the seq; the winner CAS-deletes    *)
+(* its burned orphans only AFTER its own commit. A lost CAS deletes the        *)
+(* writer's own segment at the exact version it wrote. An ambiguous CAS        *)
+(* resolves by re-reading and, on "not listed", LEAVES THE SEGMENT IN PLACE    *)
+(* -- the write may still land late.                                           *)
+(*                                                                             *)
+(* Presence is not the whole property. The store contract's axioms include     *)
+(* at-least-once delivery (a conditional DELETE can arrive twice, late) and    *)
+(* S3-shaped version ABA (the token is the content hash, so byte-identical     *)
+(* re-creates alias old delete tokens). A publisher whose retried segment is   *)
+(* byte-identical can then lose its re-create to its own first attempt's       *)
+(* stale delete, a competitor can re-create the key with different bytes, and  *)
+(* the publisher's late-landing CAS commits a manifest whose descriptor        *)
+(* resolves to someone else's entries: cold replay forks from what the warm    *)
+(* writer acknowledged (C3). The portable guard is BYTE UNIQUENESS PER         *)
+(* ATTEMPT -- a fresh nonce in every attempt's frame -- which un-aliases the   *)
+(* delete tokens on any store; incarnation-unique versions (GCS generations)   *)
+(* make the store immune regardless.                                           *)
+(*                                                                             *)
+(* Toggles, all named for the wrong implementation they model:                 *)
+(*   BurnedAcrossRetry  -- keep the burned list when the own CAS loses.        *)
+(*   SweepEarly         -- sweep burned orphans before the own commit.         *)
+(*   DropOnAmbiguous    -- delete the own segment after "not listed".          *)
+(*   StoreABA           -- versions are content hashes (S3), not fresh         *)
+(*                         incarnations (GCS); deletes may deliver twice,      *)
+(*                         late.                                               *)
+(*   DeterministicBytes -- retried attempts re-encode identical bytes (no      *)
+(*                         per-attempt nonce).                                 *)
+(* The fix arm holds the first three off and survives StoreABA because bytes   *)
+(* are attempt-unique; StoreABA + DeterministicBytes reproduces the fork.      *)
+(*                                                                             *)
+(* Abstractions: content is (writer, attempt); a version is that content       *)
+(* under StoreABA, else a fresh incarnation counter. Head-preserving manifest  *)
+(* edits (pack reclassification) bump the CAS token without touching the log,  *)
+(* which is what hands a retried publisher the same sequence twice. Writers    *)
+(* restart after walking away (a new request on the same or another host).     *)
+(* Entry semantics, packs and refs stay out of scope.                          *)
+
+EXTENDS Naturals, FiniteSets, TLC
+
+CONSTANTS BurnedAcrossRetry, SweepEarly, DropOnAmbiguous, StoreABA,
+          DeterministicBytes
+
+Writers == {"a", "b"}
+MaxSeq == 3
+Seqs == 1..MaxSeq
+MaxBurn == 2
+MaxAttempt == 2
+NoSeg == [w |-> "none", n |-> 0]
+
+Content(x, attempt) ==
+  IF DeterministicBytes THEN [w |-> x, n |-> 1] ELSE [w |-> x, n |-> attempt]
+
+VARIABLES
+  seg,      \* seg[s]: NoSeg or the content sitting at log/<s>
+  incarn,   \* incarn[s]: creates ever done at log/<s> (fresh-version stores)
+  head,     \* manifest head_seq
+  listedc,  \* the committed descriptors: seq -> content the CAS's writer wrote
+  mver,     \* manifest CAS token
+  pdel,     \* in-flight conditional deletes: {[s, ver, left]} with left <= 2
+  wr        \* per-writer state machine
+vars == <<seg, incarn, head, listedc, mver, pdel, wr>>
+
+\* A version under ABA is the content itself (byte hash); otherwise the
+\* incarnation number -- unique per create, so stale tokens can never match.
+VerOf(s, c) == IF StoreABA THEN c ELSE [w |-> "i", n |-> incarn[s]]
+
+Init ==
+  /\ seg = [s \in Seqs |-> NoSeg]
+  /\ incarn = [s \in Seqs |-> 0]
+  /\ head = 0 /\ listedc = <<>> /\ mver = 0 /\ pdel = {}
+  /\ wr = [x \in Writers |->
+       [pc |-> "idle", mv |-> 0, seq |-> 0, attempt |-> 0, ver |-> NoSeg,
+        burned |-> {}, retried |-> FALSE, ambig |-> FALSE, crashed |-> FALSE]]
+
+Listed == DOMAIN listedc
+
+\* Capture the publication view; also how a walked-away or finished writer
+\* comes back as a fresh request.
+Start(x) ==
+  /\ wr[x].pc \in {"idle", "gone", "done"} /\ head < MaxSeq
+  /\ wr[x].attempt < MaxAttempt
+  /\ wr' = [wr EXCEPT ![x].pc = "probe", ![x].mv = mver,
+                      ![x].seq = head + 1, ![x].burned = {}, ![x].ambig = FALSE]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+\* Exclusive create: this attempt's bytes land at the key.
+ClaimFree(x) ==
+  /\ wr[x].pc = "probe" /\ seg[wr[x].seq] = NoSeg
+  /\ LET c == Content(x, wr[x].attempt + 1) IN
+     /\ seg' = [seg EXCEPT ![wr[x].seq] = c]
+     /\ incarn' = [incarn EXCEPT ![wr[x].seq] = @ + 1]
+     /\ wr' = [wr EXCEPT ![x].pc = "armed", ![x].attempt = @ + 1,
+                         ![x].ver = IF StoreABA THEN c
+                                    ELSE [w |-> "i", n |-> incarn[wr[x].seq] + 1]]
+  /\ UNCHANGED <<head, listedc, mver, pdel>>
+
+\* Occupied with the head moved past it: someone committed. Restart the whole
+\* claim against a fresh view; the burned list dies with the old call.
+Contended(x) ==
+  /\ wr[x].pc = "probe" /\ seg[wr[x].seq] # NoSeg /\ head >= wr[x].seq
+  /\ head < MaxSeq
+  /\ wr' = [wr EXCEPT ![x].mv = mver, ![x].seq = head + 1, ![x].burned = {}]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+\* Occupied with the head unmoved: an orphan (crashed, or mid-flight -- the
+\* probe cannot tell). Burn: remember the version for a post-commit delete.
+Burn(x) ==
+  /\ wr[x].pc = "probe" /\ seg[wr[x].seq] # NoSeg /\ head < wr[x].seq
+  /\ wr[x].seq < MaxSeq /\ Cardinality(wr[x].burned) < MaxBurn
+  /\ wr' = [wr EXCEPT
+       ![x].burned = @ \cup {<<wr[x].seq, VerOf(wr[x].seq, seg[wr[x].seq])>>},
+       ![x].seq = @ + 1]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+\* The manifest CAS wins: the token is current, the descriptor now binds this
+\* writer's bytes at this seq.
+CasOk(x) ==
+  /\ wr[x].pc = "armed" /\ mver = wr[x].mv
+  /\ head' = wr[x].seq /\ mver' = mver + 1
+  /\ listedc' = listedc @@ (wr[x].seq :> Content(x, wr[x].attempt))
+  /\ wr' = [wr EXCEPT ![x].pc = "sweep"]
+  /\ UNCHANGED <<seg, incarn, pdel>>
+
+\* Post-commit sweep: SEND a conditional delete per burned orphan. Deletes are
+\* at-least-once: each may deliver up to twice, arbitrarily late. SweepEarly
+\* runs this while still armed -- before the own commit proved anything.
+SweepAt(x, pc) ==
+  /\ wr[x].pc = pc
+  /\ pdel' = pdel \cup {[s |-> b[1], ver |-> b[2], left |-> 2] : b \in wr[x].burned}
+  /\ wr' = [wr EXCEPT ![x].pc = IF pc = "sweep" THEN "done" ELSE "armed",
+                      ![x].burned = {}]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver>>
+
+Sweep(x) == IF SweepEarly THEN SweepAt(x, "armed") ELSE SweepAt(x, "sweep")
+
+\* A conditional delete delivers: it removes the segment only at the exact
+\* version it was issued against -- which under ABA can alias a byte-identical
+\* re-create. Duplicates and late delivery are the store's prerogative.
+DeliverDelete ==
+  \E d \in pdel :
+    /\ seg' = IF seg[d.s] # NoSeg /\ VerOf(d.s, seg[d.s]) = d.ver
+              THEN [seg EXCEPT ![d.s] = NoSeg] ELSE seg
+    /\ pdel' = (pdel \ {d}) \cup
+               (IF d.left > 1 THEN {[d EXCEPT !.left = 1]} ELSE {})
+    /\ UNCHANGED <<incarn, head, listedc, mver, wr>>
+
+\* The manifest CAS loses: someone committed since the capture. Send the
+\* conditional delete of the OWN segment (exact version) and start over
+\* against a fresh view; the burned list is discarded with the failed attempt.
+CasLost(x) ==
+  /\ wr[x].pc = "armed" /\ mver # wr[x].mv
+  /\ head < MaxSeq /\ wr[x].attempt < MaxAttempt
+  /\ pdel' = pdel \cup {[s |-> wr[x].seq, ver |-> wr[x].ver, left |-> 2]}
+  /\ wr' = [wr EXCEPT ![x].pc = "probe", ![x].mv = mver,
+                      ![x].seq = head + 1, ![x].retried = TRUE,
+                      ![x].burned = IF BurnedAcrossRetry THEN @ ELSE {}]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver>>
+
+\* A head-preserving manifest edit (pack reclassification): the CAS token
+\* moves, the log does not -- which is what hands a retrying publisher the
+\* same sequence twice.
+ManifestEdit ==
+  /\ mver < 6
+  /\ mver' = mver + 1
+  /\ UNCHANGED <<seg, incarn, head, listedc, pdel, wr>>
+
+\* The CAS reply is lost while the write may still be in flight; the writer
+\* resolves, the store may land the write whenever the token is still current
+\* -- including after the writer crashed or walked away.
+CasAmbiguous(x) ==
+  /\ wr[x].pc = "armed"
+  /\ wr' = [wr EXCEPT ![x].pc = "resolve", ![x].ambig = TRUE]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+LandLate(x) ==
+  /\ wr[x].ambig /\ mver = wr[x].mv
+  /\ head' = wr[x].seq /\ mver' = mver + 1
+  /\ listedc' = listedc @@ (wr[x].seq :> Content(x, wr[x].attempt))
+  /\ UNCHANGED <<seg, incarn, pdel, wr>>
+
+ResolveListed(x) ==
+  /\ wr[x].pc = "resolve" /\ wr[x].seq \in Listed
+  /\ wr' = [wr EXCEPT ![x].pc = "sweep"]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+\* Not listed: the write may STILL land -- leave the segment alone and walk
+\* away. DropOnAmbiguous sends the own delete here; the late landing then
+\* commits a descriptor over a hole.
+ResolveNotListed(x) ==
+  /\ wr[x].pc = "resolve" /\ wr[x].seq \notin Listed
+  /\ pdel' = IF DropOnAmbiguous
+             THEN pdel \cup {[s |-> wr[x].seq, ver |-> wr[x].ver, left |-> 2]}
+             ELSE pdel
+  /\ wr' = [wr EXCEPT ![x].pc = "gone"]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver>>
+
+\* A crash at any seam. The segment, the pending deletes, and -- crucially --
+\* an in-flight manifest CAS all outlive the process: LandLate stays enabled
+\* for a crashed-while-armed writer, because the store does not know or care
+\* that the sender died.
+Crash(x) ==
+  /\ wr[x].pc \in {"probe", "armed", "sweep", "resolve"}
+  /\ wr' = [wr EXCEPT ![x].pc = "gone",
+                      ![x].ambig = @ \/ wr[x].pc = "armed",
+                      ![x].crashed = TRUE]
+  /\ UNCHANGED <<seg, incarn, head, listedc, mver, pdel>>
+
+WorkNext ==
+  \/ DeliverDelete \/ ManifestEdit
+  \/ \E x \in Writers :
+       Start(x) \/ ClaimFree(x) \/ Contended(x) \/ Burn(x) \/ CasOk(x)
+       \/ Sweep(x) \/ CasLost(x) \/ CasAmbiguous(x) \/ LandLate(x)
+       \/ ResolveListed(x) \/ ResolveNotListed(x) \/ Crash(x)
+
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+TypeOK ==
+  /\ head \in 0..MaxSeq /\ mver \in 0..9
+  /\ \A s \in Seqs : incarn[s] \in 0..4
+  /\ \A x \in Writers : wr[x].pc \in {"idle", "probe", "armed", "sweep",
+                                      "resolve", "done", "gone"}
+
+\* Replay from any committed manifest finds every listed segment...
+CommittedSegmentsPresent == \A s \in Listed : seg[s] # NoSeg
+
+\* ...and finds the BYTES the committing writer's descriptor meant. A present
+\* key holding another attempt's or another writer's entries is a fork between
+\* what was acknowledged and what a cold start replays.
+CommittedSegmentsMatch == \A s \in Listed : seg[s] = listedc[s]
+
+\* Reachability witnesses (negated; each must FAIL in the fix arm).
+NoOrphanSwept ==
+  ~(\E x \in Writers : wr[x].pc = "done"
+      /\ \E s \in Seqs : incarn[s] # 0 /\ seg[s] = NoSeg /\ s \notin Listed)
+NoRetryCommit == ~(\E x \in Writers : wr[x].retried /\ wr[x].pc = "done")
+NoAmbiguousCommit == ~(\E x \in Writers : wr[x].ambig /\ wr[x].seq \in Listed)
+NoCrashLateCommit ==
+  ~(\E x \in Writers : wr[x].crashed /\ wr[x].ambig /\ wr[x].seq \in Listed)
+==================================================================================
diff --git a/docs/spec/scratch/LogSlotClaim_aba_deterministic.cfg b/docs/spec/scratch/LogSlotClaim_aba_deterministic.cfg
new file mode 100644
index 0000000..73ddf48
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim_aba_deterministic.cfg
@@ -0,0 +1,8 @@
+SPECIFICATION Spec
+CONSTANTS
+    BurnedAcrossRetry = FALSE
+    SweepEarly = FALSE
+    DropOnAmbiguous = FALSE
+    StoreABA = TRUE
+    DeterministicBytes = TRUE
+INVARIANT CommittedSegmentsMatch
diff --git a/docs/spec/scratch/LogSlotClaim_burned_retry.cfg b/docs/spec/scratch/LogSlotClaim_burned_retry.cfg
new file mode 100644
index 0000000..1a3968a
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim_burned_retry.cfg
@@ -0,0 +1,8 @@
+SPECIFICATION Spec
+CONSTANTS
+    BurnedAcrossRetry = TRUE
+    SweepEarly = FALSE
+    DropOnAmbiguous = FALSE
+    StoreABA = FALSE
+    DeterministicBytes = FALSE
+INVARIANT CommittedSegmentsPresent
diff --git a/docs/spec/scratch/LogSlotClaim_drop_ambiguous.cfg b/docs/spec/scratch/LogSlotClaim_drop_ambiguous.cfg
new file mode 100644
index 0000000..6a9f7f0
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim_drop_ambiguous.cfg
@@ -0,0 +1,8 @@
+SPECIFICATION Spec
+CONSTANTS
+    BurnedAcrossRetry = FALSE
+    SweepEarly = FALSE
+    DropOnAmbiguous = TRUE
+    StoreABA = FALSE
+    DeterministicBytes = FALSE
+INVARIANT CommittedSegmentsPresent
diff --git a/docs/spec/scratch/LogSlotClaim_early_sweep.cfg b/docs/spec/scratch/LogSlotClaim_early_sweep.cfg
new file mode 100644
index 0000000..16cc2fd
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim_early_sweep.cfg
@@ -0,0 +1,8 @@
+SPECIFICATION Spec
+CONSTANTS
+    BurnedAcrossRetry = FALSE
+    SweepEarly = TRUE
+    DropOnAmbiguous = FALSE
+    StoreABA = FALSE
+    DeterministicBytes = FALSE
+INVARIANT CommittedSegmentsPresent
diff --git a/docs/spec/scratch/LogSlotClaim_fix.cfg b/docs/spec/scratch/LogSlotClaim_fix.cfg
new file mode 100644
index 0000000..89ca6dd
--- /dev/null
+++ b/docs/spec/scratch/LogSlotClaim_fix.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    BurnedAcrossRetry = FALSE
+    SweepEarly = FALSE
+    DropOnAmbiguous = FALSE
+    StoreABA = TRUE
+    DeterministicBytes = FALSE
+INVARIANT TypeOK
+INVARIANT CommittedSegmentsPresent
+INVARIANT CommittedSegmentsMatch
diff --git a/docs/spec/scratch/ManifestComposition.tla b/docs/spec/scratch/ManifestComposition.tla
new file mode 100644
index 0000000..df4e82a
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition.tla
@@ -0,0 +1,263 @@
+--------------------------- MODULE ManifestComposition ---------------------------
+(* Three writer families over one manifest: does the whole stay honest when   *)
+(* every part is guarded alone?                                               *)
+(*                                                                             *)
+(* The manifest is a single CAS'd object carrying fields owned by different   *)
+(* writers: head and the segment list (publication), checkpoint and min_seq   *)
+(* (the fold), the live pack set (compaction), refs riding the log. Each      *)
+(* family's own fragment is green in isolation; this fragment interleaves     *)
+(* them, because the class only composition can see is CROSS-FIELD CLOBBER.   *)
+(* The version-gated CAS protects a FIRST attempt by construction (token      *)
+(* unchanged means base unchanged); the hazard is precisely the retry that    *)
+(* refreshes its token but keeps its captured base -- it then writes every    *)
+(* other family's fields as they were before the commit that beat it: a      *)
+(* checkpoint erasing a seal's work, a seal reverting a fold, either          *)
+(* dragging head backwards. Worse than the direct    *)
+(* damage: a dragged head breaks the assumption the log-slot claim protocol   *)
+(* stands on (LogSlotClaim reads the committed head to tell orphans from      *)
+(* commits), so one clobber poisons a neighboring protocol's soundness. The   *)
+(* fixed model clones the attempt manifest at every CAS; StaleBase* are the  *)
+(* refactors that would end that.                                             *)
+(*                                                                             *)
+(* The oracle is a ghost history: every committing publication appends the    *)
+(* truth it published. A cold start -- checkpoint refs, then the LISTED log   *)
+(* tail, over the LIVE packs -- must reconstruct exactly that truth.          *)
+(*                                                                             *)
+(* The seal here IS a WAL publication, as in the fixed model: it claims a   *)
+(* sequence, appends its COMPACT segment, advances head, and swaps the pack  *)
+(* set. That is what lets a checkpoint fold ACROSS a seal's log entry and a  *)
+(* second seal replan over the first one's output -- both schedules v1 of    *)
+(* this fragment could not reach.                                            *)
+(*                                                                             *)
+(* Kept out on purpose: ambiguity/late landing (LogSlotClaim and              *)
+(* BatchPublication own it per writer), object-graph depth (Closure-          *)
+(* Provenance owns closure; coverage here is tip membership), a CONCURRENT    *)
+(* second sealer (ClosureProvenance owns the plan-inputs clause; here seals   *)
+(* are sequential replans of one actor).                                      *)
+
+EXTENDS Naturals, FiniteSets
+
+CONSTANTS StaleBaseCheckpoint, StaleBaseSeal, NoCpGuard, NoTipsClause
+
+MaxSeq == 6
+Seqs == 1..MaxSeq
+Cps == {"c1", "c2"}
+NoVal == "none"
+
+VARIABLES
+  m,        \* the manifest: [head, cpSeq, cpRefs, segs, packs, ver]
+  refs,     \* the linearized truth of ref A right now
+  histLen,  \* ghost: how many entries have actually committed
+  histRefs, \* ghost: histRefs[s] = the truth after seq s committed
+  pu,       \* the publisher:     [pc, mv, k]
+  cp,       \* two checkpointers: cp[c] = [pc, mv, mySeq, myRefs, base, skips]
+  se        \* the sealer: [pc, mv, planPacks, sup, out, base, refusals, sealed]
+vars == <<m, refs, histLen, histRefs, pu, cp, se>>
+
+\* Pack contents, tip-membership only: P1 carries v1; a fold output covers
+\* the single value it was cut for; Qnone covers nothing.
+Covers(val, packs) ==
+  \/ val = NoVal
+  \/ (val = "v1" /\ ({"P1", "Qv1"} \cap packs) # {})
+
+Init ==
+  /\ m = [head |-> 0, cpSeq |-> 0, cpRefs |-> NoVal, segs |-> {},
+          packs |-> {}, ver |-> 0]
+  /\ refs = NoVal /\ histLen = 0
+  /\ histRefs = [s \in 0..MaxSeq |-> NoVal]
+  /\ pu = [pc |-> "idle", mv |-> 0, k |-> 0]
+  /\ cp = [c \in Cps |-> [pc |-> "idle", mv |-> 0, mySeq |-> 0,
+                          myRefs |-> NoVal, base |-> m, skips |-> 0]]
+  /\ se = [pc |-> "idle", mv |-> 0, planPacks |-> {}, sup |-> {},
+           out |-> NoVal, base |-> m, refusals |-> 0, sealed |-> 0]
+
+------------------------------------------------------------------------------
+(* The publisher: push 1 creates A=v1 carrying its own pack P1; push 2       *)
+(* deletes A. Exclusive slot creation is the floor: only the true next       *)
+(* sequence can be claimed, which is what stalls publication (instead of     *)
+(* silently rewriting history) once a clobbered head lies.                   *)
+
+PuStart ==
+  /\ pu.pc = "idle" /\ pu.k < 3 /\ m.head < MaxSeq
+  /\ pu' = [pu EXCEPT !.pc = "armed", !.mv = m.ver]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, cp, se>>
+
+PuCas ==
+  /\ pu.pc = "armed" /\ m.ver = pu.mv
+  /\ m.head + 1 = histLen + 1   \* the exclusive-create floor: head is honest
+  /\ LET s == m.head + 1
+         \* Push 1 creates A=v1 with its own pack; push 2 deletes A; push 3
+         \* is the packless revival back onto v1 -- lawful whenever some
+         \* live pack still carries v1, and the sharpest thing a stale cut
+         \* can strand.
+         newv == IF pu.k = 1 THEN NoVal ELSE "v1" IN
+     /\ pu.k # 2 \/ Covers("v1", m.packs)
+     /\ m' = [m EXCEPT !.head = s, !.segs = @ \cup {s}, !.ver = @ + 1,
+                       !.packs = IF pu.k = 0 THEN @ \cup {"P1"} ELSE @]
+     /\ refs' = newv /\ histLen' = s
+     /\ histRefs' = [histRefs EXCEPT ![s] = newv]
+     /\ pu' = [pu EXCEPT !.pc = "idle", !.k = @ + 1]
+  /\ UNCHANGED <<cp, se>>
+
+\* One batched submission: the delete and the revival commit through ONE
+\* CAS as one multi-entry segment -- head jumps by two and no manifest ever
+\* exposes the intermediate deleted state. This is process_batch draining a
+\* queue, and the shape the short-body reader tripwire protects.
+PuCasBatch ==
+  /\ pu.pc = "armed" /\ m.ver = pu.mv /\ pu.k = 1
+  /\ m.head = histLen /\ m.head + 2 <= MaxSeq
+  /\ Covers("v1", m.packs)
+  /\ LET s1 == m.head + 1
+         s2 == m.head + 2 IN
+     /\ m' = [m EXCEPT !.head = s2, !.segs = @ \cup {s1, s2}, !.ver = @ + 1]
+     /\ refs' = "v1" /\ histLen' = s2
+     /\ histRefs' = [histRefs EXCEPT ![s1] = NoVal, ![s2] = "v1"]
+     /\ pu' = [pu EXCEPT !.pc = "idle", !.k = 3]
+  /\ UNCHANGED <<cp, se>>
+
+PuLost ==
+  /\ pu.pc = "armed" /\ m.ver # pu.mv
+  /\ pu' = [pu EXCEPT !.pc = "idle"]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, cp, se>>
+
+------------------------------------------------------------------------------
+(* Checkpointers: capture the head and refs as of now, fold through the CAS  *)
+(* writing every OTHER field from the ATTEMPT manifest, trim the listed      *)
+(* segments the fold absorbed. The C2 guard abandons a capture the world     *)
+(* already checkpointed past. Two instances, because the original C2         *)
+(* regression needs a newer fold to land between a stale capture and its     *)
+(* retry. StaleBaseCheckpoint writes from the CAPTURE manifest instead;      *)
+(* NoCpGuard keeps a lost capture alive across the retry.                    *)
+
+CpCapture(c) ==
+  /\ cp[c].pc = "idle" /\ m.head > m.cpSeq
+  /\ cp' = [cp EXCEPT ![c].pc = "armed", ![c].mv = m.ver,
+                      ![c].mySeq = m.head, ![c].myRefs = refs, ![c].base = m]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, se>>
+
+CpGuardSkip(c) ==
+  /\ cp[c].pc = "armed" /\ ~NoCpGuard /\ m.cpSeq >= cp[c].mySeq
+  /\ cp' = [cp EXCEPT ![c].pc = "idle", ![c].skips = @ + 1]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, se>>
+
+CpCas(c) ==
+  /\ cp[c].pc = "armed" /\ m.ver = cp[c].mv
+  /\ NoCpGuard \/ m.cpSeq < cp[c].mySeq
+  /\ LET base == IF StaleBaseCheckpoint THEN cp[c].base ELSE m IN
+     m' = [base EXCEPT !.cpSeq = cp[c].mySeq, !.cpRefs = cp[c].myRefs,
+                       !.segs = {s \in base.segs : s > cp[c].mySeq},
+                       !.ver = m.ver + 1]
+  /\ cp' = [cp EXCEPT ![c].pc = "idle"]
+  /\ UNCHANGED <<refs, histLen, histRefs, pu, se>>
+
+\* A lost CAS retries the SAME fold with a fresh token -- the capture is
+\* kept, and the C2 guard against the fresh manifest is what abandons a
+\* capture the world moved past. That division of labor is the fixed
+\* protocol's shape, and exactly why the guard is load-bearing.
+CpLost(c) ==
+  /\ cp[c].pc = "armed" /\ m.ver # cp[c].mv
+  /\ cp' = [cp EXCEPT ![c].mv = m.ver]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, se>>
+
+------------------------------------------------------------------------------
+(* The sealer: plan a cut of the current packs covering the current refs,    *)
+(* seal through the CAS -- other fields from the ATTEMPT manifest, plan      *)
+(* inputs proven still live, and the tips clause proving current refs stay   *)
+(* covered by the result. StaleBaseSeal writes from the PLAN manifest;       *)
+(* NoTipsClause lets a seal strand a ref published after its plan.           *)
+
+SePlan ==
+  /\ se.pc = "idle" /\ m.packs # {} /\ se.sealed < 2
+  /\ se' = [se EXCEPT !.pc = "armed", !.mv = m.ver, !.planPacks = m.packs,
+                      !.sup = m.packs,
+                      !.out = IF refs = "v1" THEN "Qv1" ELSE "Qnone",
+                      !.base = m]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, cp>>
+
+\* A committing seal claims the next sequence, appends its COMPACT segment,
+\* advances head, and swaps the pack set; refs ride through unchanged.
+\* StaleBaseSeal keeps the fresh claim (the slot machinery is real) but
+\* writes every inherited field from the PLAN manifest: segments committed
+\* since the plan vanish from the listing -- a committed delete silently
+\* unlisted, which cold replay cannot see and ColdComplete catches.
+SeCas ==
+  /\ se.pc = "armed" /\ m.ver = se.mv
+  /\ se.planPacks \subseteq m.packs
+  /\ m.head = histLen /\ m.head < MaxSeq
+  /\ LET result == (m.packs \ se.sup) \cup {se.out}
+         s == m.head + 1 IN
+     /\ NoTipsClause \/ Covers(refs, result)
+     /\ LET base == IF StaleBaseSeal THEN se.base ELSE m IN
+        m' = [base EXCEPT !.packs = result, !.head = s,
+                          !.segs = @ \cup {s}, !.ver = m.ver + 1]
+     /\ histLen' = s
+     /\ histRefs' = [histRefs EXCEPT ![s] = refs]
+  /\ se' = [se EXCEPT !.pc = "idle", !.sealed = @ + 1]
+  /\ UNCHANGED <<refs, pu, cp>>
+
+SeRefuse ==
+  /\ se.pc = "armed" /\ m.ver = se.mv
+  /\ ~NoTipsClause
+  /\ ~Covers(refs, (m.packs \ se.sup) \cup {se.out})
+  /\ se' = [se EXCEPT !.pc = "idle", !.refusals = @ + 1]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, cp>>
+
+\* A lost CAS retries the SAME plan with a fresh token; only a refusal
+\* replans. The per-attempt clauses against the fresh manifest are what
+\* keep a stale plan from stranding anything -- which is why removing them
+\* is a mutation, not an optimization.
+SeLost ==
+  /\ se.pc = "armed" /\ m.ver # se.mv
+  /\ se' = [se EXCEPT !.mv = m.ver]
+  /\ UNCHANGED <<m, refs, histLen, histRefs, pu, cp>>
+
+WorkNext == PuStart \/ PuCas \/ PuCasBatch \/ PuLost
+        \/ (\E c \in Cps : CpCapture(c) \/ CpGuardSkip(c) \/ CpCas(c) \/ CpLost(c))
+        \/ SePlan \/ SeCas \/ SeRefuse \/ SeLost
+
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+------------------------------------------------------------------------------
+TypeOK ==
+  /\ m.head \in 0..MaxSeq /\ m.cpSeq \in 0..MaxSeq /\ m.ver \in 0..30
+  /\ se.sealed \in 0..2
+  /\ m.segs \subseteq Seqs /\ pu.k \in 0..3 /\ histLen \in 0..MaxSeq
+
+\* Head never lies about how much history committed: the field a clobber
+\* drags backwards, and the field every neighboring protocol trusts.
+HeadTruthful == m.head = histLen
+
+\* The checkpoint's refs are the truth as of its seq, and it never claims
+\* history that has not happened.
+CpTruthful ==
+  /\ m.cpSeq <= histLen
+  /\ m.cpSeq = 0 \/ m.cpRefs = histRefs[m.cpSeq]
+
+\* Every seq between the checkpoint and head stays listed for replay: with
+\* CpTruthful this is exactly "a cold start reconstructs the truth".
+ColdComplete == \A s \in Seqs : (s > m.cpSeq /\ s <= m.head) => s \in m.segs
+
+\* Every current ref resolves inside the live pack set.
+ColdServable == Covers(refs, m.packs)
+
+\* Witnesses (negated; each must FAIL in the fix arm): all three families
+\* commit in one behavior; a fold really trims while cold stays complete; the
+\* tips clause really refuses a stale cut; the C2 guard really skips a
+\* superseded capture.
+NoTripleCommit ==
+  ~(/\ pu.k >= 2 /\ m.cpSeq > 0
+    /\ ({"Qv1", "Qnone"} \cap m.packs) # {})
+NoTrimmedButComplete ==
+  ~(/\ m.cpSeq > 0
+    /\ \E s \in Seqs : s <= m.cpSeq /\ s \notin m.segs /\ s <= m.head
+    /\ \A s \in Seqs : (s > m.cpSeq /\ s <= m.head) => s \in m.segs)
+NoSealRefusal == se.refusals = 0
+NoGuardSkip == \A c \in Cps : cp[c].skips = 0
+\* A seal really commits as a WAL publication (head moved, segment listed).
+NoSealCommit == se.sealed = 0
+\* The composed story in one behavior: a successful seal, a later refusal,
+\* a fold, and the full push script.
+NoCompositeStory ==
+  ~(/\ se.sealed >= 1 /\ se.refusals >= 1 /\ m.cpSeq > 0 /\ pu.k = 3)
+==================================================================================
diff --git a/docs/spec/scratch/ManifestComposition_fix.cfg b/docs/spec/scratch/ManifestComposition_fix.cfg
new file mode 100644
index 0000000..123450e
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition_fix.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    StaleBaseCheckpoint = FALSE
+    StaleBaseSeal = FALSE
+    NoCpGuard = FALSE
+    NoTipsClause = FALSE
+INVARIANT TypeOK
+INVARIANT HeadTruthful
+INVARIANT CpTruthful
+INVARIANT ColdComplete
+INVARIANT ColdServable
diff --git a/docs/spec/scratch/ManifestComposition_no_cp_guard.cfg b/docs/spec/scratch/ManifestComposition_no_cp_guard.cfg
new file mode 100644
index 0000000..ce9bf9d
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition_no_cp_guard.cfg
@@ -0,0 +1,7 @@
+SPECIFICATION Spec
+CONSTANTS
+    StaleBaseCheckpoint = FALSE
+    StaleBaseSeal = FALSE
+    NoCpGuard = TRUE
+    NoTipsClause = FALSE
+INVARIANT ColdComplete
diff --git a/docs/spec/scratch/ManifestComposition_no_tips.cfg b/docs/spec/scratch/ManifestComposition_no_tips.cfg
new file mode 100644
index 0000000..64e8548
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition_no_tips.cfg
@@ -0,0 +1,7 @@
+SPECIFICATION Spec
+CONSTANTS
+    StaleBaseCheckpoint = FALSE
+    StaleBaseSeal = FALSE
+    NoCpGuard = FALSE
+    NoTipsClause = TRUE
+INVARIANT ColdServable
diff --git a/docs/spec/scratch/ManifestComposition_stale_base_cp.cfg b/docs/spec/scratch/ManifestComposition_stale_base_cp.cfg
new file mode 100644
index 0000000..351544c
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition_stale_base_cp.cfg
@@ -0,0 +1,7 @@
+SPECIFICATION Spec
+CONSTANTS
+    StaleBaseCheckpoint = TRUE
+    StaleBaseSeal = FALSE
+    NoCpGuard = FALSE
+    NoTipsClause = FALSE
+INVARIANT HeadTruthful
diff --git a/docs/spec/scratch/ManifestComposition_stale_base_seal.cfg b/docs/spec/scratch/ManifestComposition_stale_base_seal.cfg
new file mode 100644
index 0000000..a36bd7c
--- /dev/null
+++ b/docs/spec/scratch/ManifestComposition_stale_base_seal.cfg
@@ -0,0 +1,7 @@
+SPECIFICATION Spec
+CONSTANTS
+    StaleBaseCheckpoint = FALSE
+    StaleBaseSeal = TRUE
+    NoCpGuard = FALSE
+    NoTipsClause = FALSE
+INVARIANT ColdComplete
diff --git a/docs/spec/scratch/PackCoverage.cfg b/docs/spec/scratch/PackCoverage.cfg
new file mode 100644
index 0000000..49f2e46
--- /dev/null
+++ b/docs/spec/scratch/PackCoverage.cfg
@@ -0,0 +1,9 @@
+SPECIFICATION Spec
+CONSTANTS
+  Fault = "none"
+INVARIANTS
+  TypeOK
+  BindingSound
+  OfferScoped
+  CompleteFetch
+  NoMetadata
diff --git a/docs/spec/scratch/PackCoverage.tla b/docs/spec/scratch/PackCoverage.tla
new file mode 100644
index 0000000..93e6b6d
--- /dev/null
+++ b/docs/spec/scratch/PackCoverage.tla
@@ -0,0 +1,167 @@
+--------------------------- MODULE PackCoverage ---------------------------
+(* C6/C10, B2/B6. A topic group subtracts a base group. Coverage
+   names exact immutable members and a pinned generation, not a watermark.
+   Prepare -> CAS/retry races retirement, reclassification, policy and tip
+   changes. Fetch captures once; later maintenance cannot splice its view.
+
+   Set membership abstracts verified raw OIDs/indexes. Pack bytes are retained
+   for in-flight reads (C10b ASSUMPTION, not a proof of the GC policy). Preparing
+   a certificate proves its physical group's objects; the dependency bundle
+   and dynamic residual must reconstruct the requested closure. No Git wire,
+   hashing, traversal, delta encoding or download implementation is modeled.
+   Public targets: WAL coverage binding and server packfile_uri selection. *)
+EXTENDS Naturals, FiniteSets, TLC
+CONSTANT Fault
+ASSUME Fault \in {"none", "retire", "scope", "policy", "generation", "dependency", "companion"}
+Packs == {"A", "D", "B", "C", "M", "R"}
+Bytes == [p \in Packs |-> CASE p = "A" -> {"a"} [] p = "D" -> {"d"}
+  [] p = "B" -> {"b"} [] p = "C" -> {"c"} [] p = "M" -> {"m"}
+  [] OTHER -> {"b", "c"}]
+Objects(ps) == UNION {Bytes[p] : p \in ps}
+Roots(epoch) == IF epoch = 1 THEN {"a", "b"} ELSE {"a", "b", "c", "d"}
+Own(epoch) == IF epoch = 1 THEN {"b"} ELSE {"b", "c"}
+BaseMembers(epoch) == IF epoch = 1 THEN {"A"} ELSE {"A", "D"}
+TopicMembers(epoch, inventory) ==
+  IF epoch = 1 THEN {"B"} ELSE IF "C" \in inventory THEN {"B", "C"} ELSE {"B", "R"}
+EmptyProof == [epoch |-> 0, policy |-> 0, members |-> {}]
+
+VARIABLES live, scope, policy, head, rev, base2, retired, reclassified,
+          phase, token, candidate, certificate, bindingOK, retried,
+          fetch, captured, offered, residual, needed, scopedOffer,
+          oldTipOffer, retryBind, crossed
+vars == <<live, scope, policy, head, rev, base2, retired, reclassified,
+          phase, token, candidate, certificate, bindingOK, retried,
+          fetch, captured, offered, residual, needed, scopedOffer,
+          oldTipOffer, retryBind, crossed>>
+View == [live |-> live, scope |-> scope, policy |-> policy, head |-> head,
+         base2 |-> base2, proof |-> certificate, rev |-> rev]
+MemberScope(ps, inventory, scopes) ==
+  ps \subseteq inventory /\ \A p \in ps : scopes[p] = "code"
+
+Init ==
+  /\ live = Packs \ {"R"}
+  /\ scope = [p \in Packs |-> IF p = "M" THEN "meta" ELSE "code"]
+  /\ policy = 0 /\ head = 1 /\ rev = 0 /\ base2 = FALSE
+  /\ retired = FALSE /\ reclassified = FALSE
+  /\ phase = "prepare" /\ token = 0 /\ candidate = EmptyProof
+  /\ certificate = EmptyProof /\ bindingOK = TRUE /\ retried = FALSE
+  /\ fetch = "idle" /\ captured = View
+  /\ offered = {} /\ residual = {} /\ needed = {} /\ scopedOffer = TRUE
+  /\ oldTipOffer = FALSE /\ retryBind = FALSE /\ crossed = FALSE
+
+Prepare ==
+  /\ phase = "prepare" /\ policy = 0
+  /\ LET members == TopicMembers(head, live) IN
+       /\ MemberScope(members, live, scope)
+       /\ Own(head) \subseteq Objects(members)
+       /\ candidate' = [epoch |-> head, policy |-> policy, members |-> members]
+  /\ token' = rev /\ phase' = "publish"
+  /\ UNCHANGED <<live, scope, policy, head, rev, base2, retired, reclassified,
+       certificate, bindingOK, retried, fetch, captured, offered, residual,
+       needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+
+(* The proof's policy is the captured policy. A global settings change may
+   leave a stored certificate stale: it must NOT become eligible for fetch.
+   Member disappearance/scope changes, however, reject the binding itself. *)
+Bind ==
+  /\ phase = "publish" /\ token = rev
+  /\ candidate.members \subseteq live \/ Fault = "retire"
+  /\ (\A p \in candidate.members : scope[p] = "code") \/ Fault = "scope"
+  /\ certificate' = candidate /\ phase' = "done" /\ rev' = rev + 1
+  /\ bindingOK' = MemberScope(candidate.members, live, scope)
+  /\ retryBind' = retried
+  /\ UNCHANGED <<live, scope, policy, head, base2, retired, reclassified,
+       token, candidate, retried, fetch, captured, offered, residual,
+       needed, scopedOffer, oldTipOffer, crossed>>
+
+Retry ==
+  /\ phase = "publish" /\ token # rev
+  /\ token' = rev /\ retried' = TRUE
+  /\ UNCHANGED <<live, scope, policy, head, rev, base2, retired, reclassified,
+       phase, candidate, certificate, bindingOK, fetch, captured, offered,
+       residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+
+(* Retirement conserves objects and retains old bytes. Reclassification
+   invalidates membership, not the immutable content-addressed bytes. *)
+Retire ==
+  /\ ~retired /\ retired' = TRUE /\ live' = (live \ {"C"}) \cup {"R"}
+  /\ rev' = rev + 1
+  /\ UNCHANGED <<scope, policy, head, base2, reclassified, phase, token,
+       candidate, certificate, bindingOK, retried, fetch, captured, offered,
+       residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+Reclassify ==
+  /\ ~reclassified /\ reclassified' = TRUE
+  /\ scope' = [scope EXCEPT !["C"] = "meta"] /\ rev' = rev + 1
+  /\ UNCHANGED <<live, policy, head, base2, retired, phase, token, candidate,
+       certificate, bindingOK, retried, fetch, captured, offered, residual,
+       needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+ChangePolicy ==
+  /\ policy = 0 /\ policy' = 1 /\ rev' = rev + 1
+  /\ UNCHANGED <<live, scope, head, base2, retired, reclassified, phase, token,
+       candidate, certificate, bindingOK, retried, fetch, captured, offered,
+       residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+Push ==
+  /\ head = 1 /\ head' = 2 /\ rev' = rev + 1
+  /\ UNCHANGED <<live, scope, policy, base2, retired, reclassified, phase,
+       token, candidate, certificate, bindingOK, retried, fetch, captured,
+       offered, residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+BaseProof ==
+  /\ head = 2 /\ ~base2 /\ base2' = TRUE /\ rev' = rev + 1
+  /\ UNCHANGED <<live, scope, policy, head, retired, reclassified, phase,
+       token, candidate, certificate, bindingOK, retried, fetch, captured,
+       offered, residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+
+Capture ==
+  /\ fetch = "idle" /\ captured' = View /\ fetch' = "select"
+  /\ UNCHANGED <<live, scope, policy, head, rev, base2, retired, reclassified,
+       phase, token, candidate, certificate, bindingOK, retried, offered,
+       residual, needed, scopedOffer, oldTipOffer, retryBind, crossed>>
+
+Select ==
+  /\ fetch = "select"
+  /\ LET v == captured
+         p == v.proof
+         usable == /\ p.epoch > 0
+                   /\ p.policy = v.policy \/ Fault = "policy"
+                   /\ MemberScope(p.members, v.live, v.scope)
+                   /\ p.epoch = 1 \/ v.base2 \/ Fault = "generation"
+         dep == IF Fault = "dependency" THEN {}
+                ELSE BaseMembers(IF Fault = "generation" THEN 1 ELSE p.epoch)
+         members == p.members \cup dep
+         sent == IF Fault = "companion" THEN members \ {"C"} ELSE members
+     IN /\ offered' = IF usable THEN sent ELSE {}
+        /\ needed' = Roots(v.head)
+        /\ residual' = IF usable THEN Roots(v.head) \ Roots(p.epoch) ELSE Roots(v.head)
+        /\ scopedOffer' = (~usable \/ (p.policy = v.policy /\ MemberScope(sent, v.live, v.scope)))
+        /\ oldTipOffer' = (usable /\ p.epoch < v.head)
+  /\ crossed' = (rev # captured.rev)
+  /\ fetch' = "done"
+  /\ UNCHANGED <<live, scope, policy, head, rev, base2, retired, reclassified,
+       phase, token, candidate, certificate, bindingOK, retried, captured, retryBind>>
+
+WorkNext == Prepare \/ Bind \/ Retry \/ Retire \/ Reclassify \/ ChangePolicy
+        \/ Push \/ BaseProof \/ Capture \/ Select
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+TypeOK ==
+  /\ live \subseteq Packs /\ scope \in [Packs -> {"code", "meta"}]
+  /\ policy \in 0..1 /\ head \in 1..2 /\ rev \in 0..6 /\ token \in 0..6
+  /\ base2 \in BOOLEAN /\ retired \in BOOLEAN /\ reclassified \in BOOLEAN
+  /\ phase \in {"prepare", "publish", "done"} /\ fetch \in {"idle", "select", "done"}
+  /\ candidate \in [epoch : 0..2, policy : 0..1, members : SUBSET Packs]
+  /\ certificate \in [epoch : 0..2, policy : 0..1, members : SUBSET Packs]
+  /\ bindingOK \in BOOLEAN /\ retried \in BOOLEAN /\ scopedOffer \in BOOLEAN
+  /\ offered \subseteq Packs /\ residual \subseteq {"a", "b", "c", "d"}
+  /\ needed \subseteq {"a", "b", "c", "d"}
+  /\ oldTipOffer \in BOOLEAN /\ retryBind \in BOOLEAN /\ crossed \in BOOLEAN
+BindingSound == bindingOK
+OfferScoped == scopedOffer
+CompleteFetch == fetch = "done" => needed \subseteq Objects(offered) \cup residual
+NoMetadata == "m" \notin Objects(offered)
+NoRetryBind == ~retryBind
+NoOldTipOffer == ~oldTipOffer
+NoCompleteNewOffer == ~(fetch = "done" /\ captured.proof.epoch = 2 /\ offered # {})
+NoConcurrentOffer == ~(fetch = "done" /\ crossed /\ offered # {})
+=============================================================================
diff --git a/docs/spec/scratch/PackReplacement.cfg b/docs/spec/scratch/PackReplacement.cfg
new file mode 100644
index 0000000..eef7ab5
--- /dev/null
+++ b/docs/spec/scratch/PackReplacement.cfg
@@ -0,0 +1,12 @@
+SPECIFICATION Spec
+CONSTANTS
+  Broken = FALSE
+  Mode = "conserve"
+  Fault = "none"
+INVARIANTS
+  TypeOK
+  AdmissionSound
+  Conserves
+  Servable
+  WriteAhead
+  OutputClosed
diff --git a/docs/spec/scratch/PackReplacement.tla b/docs/spec/scratch/PackReplacement.tla
new file mode 100644
index 0000000..80715d7
--- /dev/null
+++ b/docs/spec/scratch/PackReplacement.tla
@@ -0,0 +1,104 @@
+------------------------- MODULE PackReplacement -------------------------
+(* C6/C10: a conserving cut validates ALL captured indexed links, not
+   just reachable roots, before compression. It conserves those indexed OIDs
+   at seal. Explicit pruning validates only the roots it deliberately retains.
+   A push may land at every stage; retry refreshes the manifest/token but MUST
+   NOT extend supersedes to packs the candidate never processed.
+
+   Each abstract pack contributes distinct OIDs, and output choice exhausts
+   every subset of the captured inputs. Hashes/compression/filesystem layout
+   are outside the model. Closure is raw direct-link closure (not bitmap
+   success). Public targets: pack_segments producer and WAL replacement seal. No production guard is inferred solely
+   from this set-level abstraction. *)
+EXTENDS Naturals, TLC
+CONSTANTS Broken, Mode, Fault
+ASSUME Broken \in BOOLEAN /\ Mode \in {"conserve", "prune"}
+ASSUME Fault \in {"none", "raw", "conserve", "replace", "supersedes"}
+Universe == 1..5
+Links(o) == CASE o = 1 -> {2} [] o = 3 /\ Broken -> {4}
+                [] o = 5 -> {1} [] OTHER -> {}
+Closed(os) == \A o \in os : Links(o) \subseteq os
+Reach(t) == IF t = 1 THEN {1, 2} ELSE {1, 2, 5}
+VARIABLES live, tip, rev, phase, input, root, token, output, durable,
+          ran, rejected, sealed, beforeSeal, retried, raced
+vars == <<live, tip, rev, phase, input, root, token, output, durable,
+          ran, rejected, sealed, beforeSeal, retried, raced>>
+Retained == IF Mode = "prune" THEN Reach(root) ELSE input
+Init ==
+  /\ live = {1, 2, 3} /\ tip = 1 /\ rev = 0 /\ phase = "capture"
+  /\ input = {} /\ root = 1 /\ token = 0 /\ output = {} /\ durable = {}
+  /\ ran = FALSE /\ rejected = FALSE /\ sealed = FALSE
+  /\ beforeSeal = {} /\ retried = FALSE /\ raced = FALSE
+Capture ==
+  /\ phase = "capture" /\ input' = live /\ root' = tip /\ token' = rev
+  /\ phase' = "admit"
+  /\ UNCHANGED <<live, tip, rev, output, durable, ran, rejected, sealed, beforeSeal, retried, raced>>
+Admit ==
+  /\ phase = "admit"
+  /\ Closed(Retained) \/ Fault = "raw"
+  /\ phase' = "compress" /\ ran' = TRUE
+  /\ UNCHANGED <<live, tip, rev, input, root, token, output, durable,
+                 rejected, sealed, beforeSeal, retried, raced>>
+RejectInput ==
+  /\ phase = "admit" /\ ~Closed(Retained) /\ Fault # "raw"
+  /\ phase' = "done" /\ rejected' = TRUE
+  /\ UNCHANGED <<live, tip, rev, input, root, token, output, durable,
+                 ran, sealed, beforeSeal, retried, raced>>
+Compress(os) ==
+  /\ phase = "compress" /\ os \subseteq input
+  /\ output' = os /\ phase' = "verify"
+  /\ UNCHANGED <<live, tip, rev, input, root, token, durable, ran,
+                 rejected, sealed, beforeSeal, retried, raced>>
+OutputOK ==
+  /\ Closed(output)
+  /\ (IF Fault = "conserve" THEN Reach(root) ELSE Retained) \subseteq output
+Verify ==
+  /\ phase = "verify"
+  /\ phase' = IF OutputOK THEN "upload" ELSE "done"
+  /\ rejected' = ~OutputOK
+  /\ UNCHANGED <<live, tip, rev, input, root, token, output, durable,
+                 ran, sealed, beforeSeal, retried, raced>>
+Upload ==
+  /\ phase = "upload" /\ durable' = output /\ phase' = "seal"
+  /\ UNCHANGED <<live, tip, rev, input, root, token, output, ran,
+                 rejected, sealed, beforeSeal, retried, raced>>
+Push ==
+  /\ tip = 1 /\ tip' = 5 /\ live' = live \cup {5} /\ rev' = rev + 1
+  /\ UNCHANGED <<phase, input, root, token, output, durable, ran,
+                 rejected, sealed, beforeSeal, retried, raced>>
+Retry ==
+  /\ phase = "seal" /\ token # rev
+  /\ token' = rev /\ retried' = TRUE
+  /\ input' = IF Fault = "supersedes" THEN live ELSE input
+  /\ UNCHANGED <<live, tip, rev, phase, root, output, durable, ran,
+                 rejected, sealed, beforeSeal, raced>>
+Seal ==
+  /\ phase = "seal" /\ token = rev
+  /\ beforeSeal' = live
+  /\ live' = IF Fault = "replace" THEN output ELSE (live \ input) \cup output
+  /\ sealed' = TRUE /\ phase' = "done" /\ rev' = rev + 1
+  /\ raced' = (tip # root)
+  /\ UNCHANGED <<tip, input, root, token, output, durable, ran, rejected, retried>>
+WorkNext == Capture \/ Admit \/ RejectInput \/ Verify \/ Upload \/ Push \/ Retry \/ Seal
+        \/ \E os \in SUBSET Universe : Compress(os)
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+TypeOK ==
+  /\ live \subseteq Universe /\ input \subseteq Universe /\ output \subseteq Universe
+  /\ durable \subseteq Universe /\ beforeSeal \subseteq Universe
+  /\ tip \in {1, 5} /\ root \in {1, 5} /\ rev \in 0..2 /\ token \in 0..2
+  /\ phase \in {"capture", "admit", "compress", "verify", "upload", "seal", "done"}
+  /\ ran \in BOOLEAN /\ rejected \in BOOLEAN /\ sealed \in BOOLEAN
+  /\ retried \in BOOLEAN /\ raced \in BOOLEAN
+AdmissionSound == ran => Closed(Retained)
+Conserves == sealed /\ Mode = "conserve" => beforeSeal \subseteq live
+Servable == Reach(tip) \subseteq live
+WriteAhead == sealed => output \subseteq durable
+OutputClosed == sealed => Closed(live)
+NoSeal == ~sealed
+NoRejectedInput == ~(rejected /\ ~ran)
+NoRacingSeal == ~(sealed /\ raced)
+NoRetrySeal == ~(sealed /\ retried)
+=============================================================================
diff --git a/docs/spec/scratch/PublicationView.tla b/docs/spec/scratch/PublicationView.tla
new file mode 100644
index 0000000..9a186f8
--- /dev/null
+++ b/docs/spec/scratch/PublicationView.tla
@@ -0,0 +1,35 @@
+------------------------- MODULE PublicationView -------------------------
+EXTENDS Naturals
+CONSTANT Fix
+VARIABLES value, token, candidate, expected, phase, lost
+vars == <<value, token, candidate, expected, phase, lost>>
+
+Init == /\ value = 0 /\ token = 0 /\ candidate = 0 /\ expected = 0
+        /\ phase = "start" /\ lost = FALSE
+
+\* A local sync/cache apply advances the protected value and its version.
+Advance == /\ value = 0 /\ value' = 1 /\ token' = 1
+           /\ UNCHANGED <<candidate, expected, phase, lost>>
+
+ReadValue == /\ phase = "start"
+             /\ candidate' = value
+             /\ expected' = IF Fix THEN token ELSE expected
+             /\ phase' = IF Fix THEN "cas" ELSE "version"
+             /\ UNCHANGED <<value, token, lost>>
+
+ReadVersion == /\ phase = "version"
+               /\ expected' = token /\ phase' = "cas"
+               /\ UNCHANGED <<value, token, candidate, lost>>
+
+\* The version check alone cannot save a candidate captured from older state.
+CAS == /\ phase = "cas" /\ expected = token
+       /\ lost' = (candidate # value) /\ phase' = "done"
+       /\ UNCHANGED <<value, token, candidate, expected>>
+
+WorkNext == Advance \/ ReadValue \/ ReadVersion \/ CAS
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+NoLostUpdate == ~lost
+=============================================================================
diff --git a/docs/spec/scratch/PublicationView_bug.cfg b/docs/spec/scratch/PublicationView_bug.cfg
new file mode 100644
index 0000000..c09d4a0
--- /dev/null
+++ b/docs/spec/scratch/PublicationView_bug.cfg
@@ -0,0 +1,3 @@
+CONSTANT Fix = FALSE
+SPECIFICATION Spec
+INVARIANT NoLostUpdate
diff --git a/docs/spec/scratch/PublicationView_fix.cfg b/docs/spec/scratch/PublicationView_fix.cfg
new file mode 100644
index 0000000..3e9f638
--- /dev/null
+++ b/docs/spec/scratch/PublicationView_fix.cfg
@@ -0,0 +1,3 @@
+CONSTANT Fix = TRUE
+SPECIFICATION Spec
+INVARIANT NoLostUpdate
diff --git a/docs/spec/scratch/ReadinessCarry.tla b/docs/spec/scratch/ReadinessCarry.tla
new file mode 100644
index 0000000..1e307a1
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry.tla
@@ -0,0 +1,314 @@
+-------------------------- MODULE ReadinessCarry --------------------------
+(***************************************************************************)
+(* One host's pack-readiness bookkeeping against one repository's manifest *)
+(* history. `RepoState` keeps two counters: `revision`, the manifest        *)
+(* revision whose refs the local copy reflects, and `packs_revision`, the   *)
+(* revision whose pack inventory is installed. `packs_ready()` is their     *)
+(* equality, and `level_satisfied(Serve)` trusts it: a ready host serves    *)
+(* objects from its local packs without reconciling. Every lane that        *)
+(* advances `revision` decides whether `packs_revision` follows ("carry"):  *)
+(*                                                                          *)
+(*   push local commit   publish.rs      PushCarry ("packs" in the code)   *)
+(*   manifest edit       publish.rs      EditCarry ("packs_proven")         *)
+(*   refs sync apply     sync.rs         ApplyCarry (proven inventory)     *)
+(*   pack reconcile      sync.rs         stamps the manifest it worked from *)
+(*   open after restart  registry.rs     OpenApplies, EmptyReady            *)
+(*   handle construction handle.rs       Sentinel: packs_revision := 0      *)
+(*                                                                          *)
+(* The two counters prove the inventory only for the revision `revision`    *)
+(* names. The model asks when a lane may trust them, and what each lane     *)
+(* costs when it does not.                                                  *)
+(*                                                                          *)
+(* Abstractions. Pack inventories are sets of identities: a pack, or a      *)
+(* side-file an annotation advertises for an installed pack (`has_rev`,     *)
+(* bitmap, graph layer). Manifest edits that leave `packs` identical are    *)
+(* settings publications, which also append a log entry; annotations and    *)
+(* reclassifications change `packs` and append none. The reconcile always   *)
+(* completes its downloads and graph maintenance (a failed pass stamps 0 in  *)
+(* the code, which only adds passes). CAS contention is not modelled: a     *)
+(* publication requires the publisher's held manifest to be current, and a  *)
+(* stale publisher adopts the store's manifest through ApplyDelta first,    *)
+(* which is what the CAS retry does. Other hosts appear only through the    *)
+(* manifests they publish. Cache-root sharing between processes, torn       *)
+(* files and reclaim are CacheDiscipline's and TempReclaim's subjects.      *)
+(***************************************************************************)
+EXTENDS Naturals, FiniteSets
+
+CONSTANTS
+  MaxRev,         \* manifest revisions explored: 1 (creation) .. MaxRev
+  Packs,          \* pack identities a push may add, each at most once
+  SideFiles,      \* side-file identities an annotation may advertise
+  Role,           \* "creator" (made the repository) | "opener" (met it later)
+  BirthRevision,  \* the state a creator persists: 1 (its manifest) or 0 (a default state)
+  Sentinel,       \* git.commit_graph: an opened handle owes one reconcile (handle.rs)
+  PushCarry,      \* "packs" | "packs_proven": the push local commit's rule
+  EditCarry,      \* "none" | "packs" | "packs_proven": cache_manifest_edit's rule
+  ApplyCarry,     \* the "packs_proven" rule inside apply_delta as well
+  OpenApplies,    \* "log": apply the loaded manifest iff applied_seq < head_seq;
+                  \* "log_or_revision": also when state.revision < manifest.revision
+  EmptyReady,     \* an open onto a manifest that names no packs is ready: an empty
+                  \* inventory is installed in any directory (registry.rs)
+  Crashes         \* whether the host may lose its process (and, on tmpfs, its disk)
+
+ASSUME Role \in {"creator", "opener"}
+ASSUME BirthRevision \in {0, 1}
+ASSUME PushCarry \in {"packs", "packs_proven"}
+ASSUME EditCarry \in {"none", "packs", "packs_proven"}
+ASSUME Sentinel \in BOOLEAN /\ ApplyCarry \in BOOLEAN /\ Crashes \in BOOLEAN
+ASSUME OpenApplies \in {"log", "log_or_revision"} /\ EmptyReady \in BOOLEAN
+ASSUME MaxRev \in Nat /\ MaxRev >= 2
+ASSUME Packs \cap SideFiles = {}
+
+Items == Packs \cup SideFiles
+Revs  == 0..MaxRev
+
+VARIABLES
+  rev,        \* the store's current manifest revision
+  inv,        \* inv[r]: the pack inventory revision r names (inv[0] = {})
+  seq,        \* head_seq: a push or a settings publication appends a log entry;
+              \* an annotation or reclassification moves the revision alone
+  alive,      \* the host process is up
+  hManifest,  \* revision of the manifest the handle holds
+  hRev,       \* RepoState.revision in memory
+  hPacksRev,  \* RepoState.packs_revision in memory
+  hSeq,       \* RepoState.applied_seq in memory
+  installed,  \* items present in the host's pack directory (survives a crash, not a wipe)
+  pRev, pPacksRev, pSeq,  \* the state file on disk
+  target,     \* revision a running reconcile works from; 0 when none runs
+  last,       \* which host lane acted most recently (for the waste witnesses)
+  wasReady,   \* whether the counters said ready just before that lane acted
+  syncRev     \* RepoState.revision when the running reconcile started
+
+vars == <<rev, inv, seq, alive, hManifest, hRev, hPacksRev, hSeq, installed,
+          pRev, pPacksRev, pSeq, target, last, wasReady, syncRev>>
+
+Ready == hPacksRev = hRev              \* RepoState::packs_ready()
+Current == alive /\ hManifest = rev    \* the CAS precondition: a current held manifest
+
+\* A lane is about to advance `revision`; does `packs_revision` follow? Judged
+\* on the state before the lane mutates it, against the inventory `newInv`
+\* the new manifest names. `packs`: identical inventory and the counters say
+\* ready. `packs_proven` adds: the counters describe the held revision.
+Carries(rule, newInv) ==
+  /\ rule # "none"
+  /\ newInv = inv[hManifest]
+  /\ Ready
+  /\ (rule = "packs_proven" => hManifest = hRev)
+
+Persist == /\ pRev' = hRev' /\ pPacksRev' = hPacksRev' /\ pSeq' = hSeq'
+
+Init ==
+  /\ rev = 1 /\ inv = [r \in Revs |-> {}] /\ seq = 0
+  /\ installed = {} /\ target = 0 /\ last = "none" /\ wasReady = FALSE /\ syncRev = 0
+  /\ IF Role = "creator"
+       THEN \* Registry::create: the handle is built and used in the same process.
+            \* With BirthRevision = 1 the creator keeps its saved readiness
+            \* (nothing inherited, so the Sentinel is bypassed); with 0 the
+            \* Sentinel's zero coincides with the default state.
+            /\ alive = TRUE /\ hManifest = 1
+            /\ hRev = BirthRevision /\ hPacksRev = BirthRevision /\ hSeq = 0
+            /\ pRev = BirthRevision /\ pPacksRev = BirthRevision /\ pSeq = 0
+       ELSE \* Someone else created it; this host has no directory yet.
+            /\ alive = FALSE /\ hManifest = 0
+            /\ hRev = 0 /\ hPacksRev = 0 /\ hSeq = 0
+            /\ pRev = 0 /\ pPacksRev = 0 /\ pSeq = 0
+
+-----------------------------------------------------------------------------
+(* Publications by this host. Each requires a current held manifest.       *)
+
+\* receive-pack: the pack is installed locally before the CAS; the local
+\* commit advances `revision` and carries per PushCarry.
+Push(p) ==
+  /\ Current /\ rev < MaxRev /\ p \notin inv[rev]
+  /\ rev' = rev + 1 /\ seq' = seq + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev] \cup {p}]
+  /\ installed' = installed \cup {p}
+  /\ hManifest' = rev + 1 /\ hRev' = rev + 1 /\ hSeq' = seq + 1
+  \* The pack this push adds is the pack it installed, so the inventory clause
+  \* holds by construction; what remains is whether the counters are trusted.
+  /\ hPacksRev' = IF Ready /\ (PushCarry = "packs_proven" => hManifest = hRev)
+                    THEN rev + 1 ELSE hPacksRev
+  /\ Persist
+  /\ last' = "push" /\ wasReady' = Ready /\ UNCHANGED syncRev
+  /\ UNCHANGED <<alive, target>>
+
+\* A settings publication through cache_manifest_edit: `packs` identical, and
+\* a log entry, so a host that missed it applies it at open.
+Edit ==
+  /\ Current /\ rev < MaxRev
+  /\ rev' = rev + 1 /\ seq' = seq + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev]]
+  /\ hManifest' = rev + 1 /\ hRev' = rev + 1 /\ hSeq' = seq + 1
+  /\ hPacksRev' = IF Carries(EditCarry, inv[rev]) THEN rev + 1 ELSE hPacksRev
+  /\ UNCHANGED <<alive, installed, target>>
+  /\ Persist
+  /\ last' = "edit" /\ wasReady' = Ready /\ UNCHANGED syncRev
+
+\* An annotation (or reclassification) through cache_manifest_edit: a PackRef
+\* changes, so no rule carries, and no log entry is written. The annotator may
+\* hold the side-file (it generated it) or not (the CLI advertises what a pack
+\* ships without holding the pack).
+Annotate(s) ==
+  /\ Current /\ rev < MaxRev /\ s \notin inv[rev] /\ inv[rev] \cap Packs # {}
+  /\ rev' = rev + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev] \cup {s}]
+  /\ hManifest' = rev + 1 /\ hRev' = rev + 1
+  /\ hPacksRev' = hPacksRev
+  /\ installed' \in {installed, installed \cup {s}}
+  /\ UNCHANGED <<seq, alive, hSeq, target>>
+  /\ Persist
+  /\ last' = "annotate" /\ wasReady' = Ready /\ UNCHANGED syncRev
+
+-----------------------------------------------------------------------------
+(* Publications by other hosts: the store moves, this host learns later.  *)
+
+ExtPush(p) ==
+  /\ rev < MaxRev /\ p \notin inv[rev]
+  /\ rev' = rev + 1 /\ seq' = seq + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev] \cup {p}]
+  /\ UNCHANGED <<alive, hManifest, hRev, hPacksRev, hSeq, installed,
+                 pRev, pPacksRev, pSeq, target, last, wasReady, syncRev>>
+
+ExtEdit ==
+  /\ rev < MaxRev
+  /\ rev' = rev + 1 /\ seq' = seq + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev]]
+  /\ UNCHANGED <<alive, hManifest, hRev, hPacksRev, hSeq, installed,
+                 pRev, pPacksRev, pSeq, target, last, wasReady, syncRev>>
+
+ExtAnnotate(s) ==
+  /\ rev < MaxRev /\ s \notin inv[rev] /\ inv[rev] \cap Packs # {}
+  /\ rev' = rev + 1
+  /\ inv' = [inv EXCEPT ![rev + 1] = inv[rev] \cup {s}]
+  /\ UNCHANGED <<seq, alive, hManifest, hRev, hPacksRev, hSeq, installed,
+                 pRev, pPacksRev, pSeq, target, last, wasReady, syncRev>>
+
+-----------------------------------------------------------------------------
+(* The host's own sync lanes.                                              *)
+
+\* The refs sync (or a CAS retry's adopt) applies a newer manifest under
+\* sync_mutex: refs first, `revision` alone; a reconcile may be running.
+ApplyDelta ==
+  /\ alive /\ hManifest < rev
+  /\ hManifest' = rev /\ hRev' = rev /\ hSeq' = seq
+  /\ hPacksRev' = IF ApplyCarry /\ Carries("packs_proven", inv[rev]) THEN rev ELSE hPacksRev
+  /\ Persist
+  /\ last' = "apply" /\ wasReady' = Ready /\ UNCHANGED syncRev
+  /\ UNCHANGED <<rev, inv, seq, alive, installed, target>>
+
+\* A Serve-level read finds level_satisfied false and starts the materialize
+\* task under pack_mutex, working from the manifest the handle holds now.
+ReconcileStart ==
+  /\ alive /\ target = 0 /\ ~Ready
+  /\ target' = hManifest /\ syncRev' = hRev /\ last' = "none"
+  /\ UNCHANGED <<rev, inv, seq, alive, hManifest, hRev, hPacksRev, hSeq,
+                 installed, pRev, pPacksRev, pSeq, wasReady>>
+
+\* The pass installs what its manifest names and stamps that manifest's
+\* revision, whatever `revision` has become meanwhile.
+ReconcileEnd ==
+  /\ alive /\ target # 0
+  /\ installed' = installed \cup inv[target]
+  /\ hPacksRev' = target
+  /\ target' = 0
+  /\ UNCHANGED <<rev, inv, seq, alive, hManifest, hRev, hSeq>>
+  /\ Persist
+  /\ last' = "reconcile" /\ wasReady' = FALSE /\ UNCHANGED syncRev
+
+-----------------------------------------------------------------------------
+(* Process life. A crash keeps the directory (a persistent cache); a wipe   *)
+(* loses it (a fresh container). Registry::open then loads the current      *)
+(* manifest and the state file, applies the delta when OpenApplies finds    *)
+(* the saved state behind, and the constructor applies the Sentinel.        *)
+
+Crash ==
+  /\ Crashes /\ alive
+  /\ alive' = FALSE /\ target' = 0 /\ last' = "none" /\ wasReady' = FALSE
+  /\ UNCHANGED <<syncRev, rev, inv, seq, hManifest, hRev, hPacksRev, hSeq, installed,
+                 pRev, pPacksRev, pSeq>>
+
+Wipe ==
+  /\ Crashes /\ alive
+  /\ alive' = FALSE /\ target' = 0 /\ last' = "none" /\ wasReady' = FALSE
+  /\ installed' = {} /\ pRev' = 0 /\ pPacksRev' = 0 /\ pSeq' = 0
+  /\ UNCHANGED <<syncRev, rev, inv, seq, hManifest, hRev, hPacksRev, hSeq>>
+
+Restart ==
+  /\ ~alive
+  /\ LET behind == pSeq < seq \/ (OpenApplies = "log_or_revision" /\ pRev < rev)
+         stateRev == IF behind THEN rev ELSE pRev
+         sentinelRev == IF Sentinel THEN 0 ELSE pPacksRev
+         packsRev == IF EmptyReady /\ inv[rev] = {} THEN stateRev ELSE sentinelRev
+     IN /\ alive' = TRUE /\ hManifest' = rev
+        /\ hRev' = stateRev
+        /\ hSeq' = IF behind THEN seq ELSE pSeq
+        /\ hPacksRev' = packsRev
+        \* The constructor applies the Sentinel, then apply_delta saves the state
+        \* it produced; a skipped apply saves nothing. The empty-inventory rule
+        \* runs after the apply and lives in memory, like the Sentinel.
+        /\ pRev' = IF behind THEN rev ELSE pRev
+        /\ pSeq' = IF behind THEN seq ELSE pSeq
+        /\ pPacksRev' = IF behind THEN sentinelRev ELSE pPacksRev
+  \* The open lane is measured like the others: the saved counters said ready.
+  /\ last' = "open" /\ wasReady' = (pPacksRev = pRev)
+  /\ UNCHANGED <<syncRev, rev, inv, seq, installed, target>>
+
+-----------------------------------------------------------------------------
+
+WorkNext ==
+  \/ \E p \in Packs : Push(p) \/ ExtPush(p)
+  \/ Edit \/ ExtEdit
+  \/ \E s \in SideFiles : Annotate(s) \/ ExtAnnotate(s)
+  \/ ApplyDelta \/ ReconcileStart \/ ReconcileEnd
+  \/ Crash \/ Wipe \/ Restart
+
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+-----------------------------------------------------------------------------
+(* Properties.                                                             *)
+
+TypeOK ==
+  /\ rev \in 1..MaxRev /\ seq \in Nat
+  /\ inv \in [Revs -> SUBSET Items] /\ inv[0] = {}
+  /\ hManifest \in Revs /\ hRev \in Revs /\ hPacksRev \in Revs
+  /\ pRev \in Revs /\ pPacksRev \in Revs
+  /\ installed \subseteq Items /\ target \in Revs
+  /\ last \in {"none", "push", "edit", "annotate", "apply", "reconcile", "open"}
+  /\ wasReady \in BOOLEAN /\ syncRev \in Revs
+
+\* Safety. Readiness is a promise about the revision `revision` names: a
+\* ready host has installed everything that revision's inventory lists.
+ReadyNamesInventory == (alive /\ Ready) => inv[hRev] \subseteq installed
+
+\* Stronger: a ready host has installed what the manifest it HOLDS lists.
+\* The refs sync never applies a manifest at the handle's own revision, so a
+\* handle that adopted a newer manifest at open without an apply would keep
+\* a state naming an older inventory for good. Holds once open applies by
+\* revision as well (the `open_log_*` configurations show it failing without).
+ReadyServesHeld == (alive /\ Ready) => inv[hManifest] \subseteq installed
+
+\* Waste. Each lane's fallback is "leave packs_revision behind". A lane that
+\* found the counters ready and left them not ready should have done so
+\* only because the next pass has something to install. Scoped to the lane's
+\* own contribution: a host already not ready before the lane acted is the
+\* previous lane's cost, not this one's.
+Complete == inv[hManifest] \subseteq installed
+LaneNeverWastes(lane) ==
+  (alive /\ last = lane /\ wasReady /\ ~Ready) => ~Complete
+
+EditNeverWastes     == LaneNeverWastes("edit")
+AnnotateNeverWastes == LaneNeverWastes("annotate")
+ApplyNeverWastes    == LaneNeverWastes("apply")
+\* The open lane: judged against the counters the state file held. The
+\* Sentinel's pass on an inherited directory is graph maintenance the model
+\* does not see, so this property is checked without it.
+OpenNeverWastes     == LaneNeverWastes("open")
+
+\* A pass that ran while `revision` stood still leaves the host ready;
+\* otherwise every Serve-level read starts another pass until something
+\* else moves `revision`. A pass overtaken by a push or an apply owes one
+\* more pass by design (its verdict expired), and is not counted.
+ReconcileSettles == (alive /\ last = "reconcile" /\ syncRev = hRev) => Ready
+
+=============================================================================
diff --git a/docs/spec/scratch/ReadinessCarry_annotate_waste.cfg b/docs/spec/scratch/ReadinessCarry_annotate_waste.cfg
new file mode 100644
index 0000000..2a7835e
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_annotate_waste.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS AnnotateNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_apply_carry.cfg b/docs/spec/scratch/ReadinessCarry_apply_carry.cfg
new file mode 100644
index 0000000..78f6e36
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_apply_carry.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = TRUE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld ReconcileSettles ApplyNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_apply_waste.cfg b/docs/spec/scratch/ReadinessCarry_apply_waste.cfg
new file mode 100644
index 0000000..d528f13
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_apply_waste.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS ApplyNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_birth_zero.cfg b/docs/spec/scratch/ReadinessCarry_birth_zero.cfg
new file mode 100644
index 0000000..9138c23
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_birth_zero.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 0
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_fixed.cfg b/docs/spec/scratch/ReadinessCarry_fixed.cfg
new file mode 100644
index 0000000..d18da72
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_fixed.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld ReconcileSettles EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_fixed_no_sentinel.cfg b/docs/spec/scratch/ReadinessCarry_fixed_no_sentinel.cfg
new file mode 100644
index 0000000..3393203
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_fixed_no_sentinel.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld ReconcileSettles
diff --git a/docs/spec/scratch/ReadinessCarry_fixed_opener.cfg b/docs/spec/scratch/ReadinessCarry_fixed_opener.cfg
new file mode 100644
index 0000000..09ce4eb
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_fixed_opener.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "opener"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld ReconcileSettles EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_fixed_opener_birth.cfg b/docs/spec/scratch/ReadinessCarry_fixed_opener_birth.cfg
new file mode 100644
index 0000000..8f8b4a3
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_fixed_opener_birth.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "opener"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld OpenNeverWastes EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_fixed_restarts.cfg b/docs/spec/scratch/ReadinessCarry_fixed_restarts.cfg
new file mode 100644
index 0000000..75dea12
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_fixed_restarts.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS TypeOK ReadyNamesInventory ReadyServesHeld ReconcileSettles
diff --git a/docs/spec/scratch/ReadinessCarry_no_carry.cfg b/docs/spec/scratch/ReadinessCarry_no_carry.cfg
new file mode 100644
index 0000000..80a4263
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_no_carry.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "none"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_open_log_loop.cfg b/docs/spec/scratch/ReadinessCarry_open_log_loop.cfg
new file mode 100644
index 0000000..28a0b7a
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_log_loop.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS ReconcileSettles
diff --git a/docs/spec/scratch/ReadinessCarry_open_log_opener.cfg b/docs/spec/scratch/ReadinessCarry_open_log_opener.cfg
new file mode 100644
index 0000000..66d24a2
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_log_opener.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "opener"
+  BirthRevision = 1
+  Sentinel = TRUE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS EditNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_open_log_push.cfg b/docs/spec/scratch/ReadinessCarry_open_log_push.cfg
new file mode 100644
index 0000000..1b5bdc8
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_log_push.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS ReadyNamesInventory
diff --git a/docs/spec/scratch/ReadinessCarry_open_log_stale.cfg b/docs/spec/scratch/ReadinessCarry_open_log_stale.cfg
new file mode 100644
index 0000000..f695674
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_log_stale.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS ReadyServesHeld
diff --git a/docs/spec/scratch/ReadinessCarry_open_not_empty_ready.cfg b/docs/spec/scratch/ReadinessCarry_open_not_empty_ready.cfg
new file mode 100644
index 0000000..1b93307
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_not_empty_ready.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "opener"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = FALSE
+  Crashes = FALSE
+SPECIFICATION Spec
+INVARIANTS OpenNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_open_waste.cfg b/docs/spec/scratch/ReadinessCarry_open_waste.cfg
new file mode 100644
index 0000000..f8afa1f
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_open_waste.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs"
+  EditCarry = "packs_proven"
+  ApplyCarry = FALSE
+  OpenApplies = "log_or_revision"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS OpenNeverWastes
diff --git a/docs/spec/scratch/ReadinessCarry_packs_only.cfg b/docs/spec/scratch/ReadinessCarry_packs_only.cfg
new file mode 100644
index 0000000..b8a2065
--- /dev/null
+++ b/docs/spec/scratch/ReadinessCarry_packs_only.cfg
@@ -0,0 +1,15 @@
+CONSTANTS
+  MaxRev = 5
+  Packs = {p1, p2}
+  SideFiles = {s1}
+  Role = "creator"
+  BirthRevision = 1
+  Sentinel = FALSE
+  PushCarry = "packs_proven"
+  EditCarry = "packs"
+  ApplyCarry = FALSE
+  OpenApplies = "log"
+  EmptyReady = TRUE
+  Crashes = TRUE
+SPECIFICATION Spec
+INVARIANTS ReadyNamesInventory
diff --git a/docs/spec/scratch/SnapshotAuthority.cfg b/docs/spec/scratch/SnapshotAuthority.cfg
new file mode 100644
index 0000000..ba37b16
--- /dev/null
+++ b/docs/spec/scratch/SnapshotAuthority.cfg
@@ -0,0 +1,8 @@
+SPECIFICATION Spec
+CONSTANTS
+  Fault = "none"
+INVARIANTS
+  TypeOK
+  DescriptorDurable
+  SnapshotAuthority
+  ReadFresh
diff --git a/docs/spec/scratch/SnapshotAuthority.tla b/docs/spec/scratch/SnapshotAuthority.tla
new file mode 100644
index 0000000..466fa23
--- /dev/null
+++ b/docs/spec/scratch/SnapshotAuthority.tla
@@ -0,0 +1,88 @@
+------------------------ MODULE SnapshotAuthority ------------------------
+(* C2/C3/C7, B5/B6. Two racing import candidates at the same sequence.
+   Immutable keys are abstract content identities; a seq-named hint can name
+   a losing upload. Only the manifest descriptor grants read authority.
+   A later checkpoint/push moves the descriptor while a multi-GET cold read
+   is in flight. A warm cache survives until Crash, but is never authority.
+   Hash correctness and exclusive immutable creation are environment axioms.
+   Targets: snapshots.rs, log_reader.rs, checkpoint.rs, sync.rs. *)
+EXTENDS Naturals, TLC
+CONSTANT Fault
+ASSUME Fault \in {"none", "cache", "guess", "splice"}
+VARIABLES uploaded, hint, winner, revision, descriptor, phase, captured,
+          floor, cache, result, crossed, readOrphanRace
+vars == <<uploaded, hint, winner, revision, descriptor, phase, captured,
+          floor, cache, result, crossed, readOrphanRace>>
+
+Init ==
+  /\ uploaded = {} /\ hint = 0 /\ winner = 0
+  /\ revision = 0 /\ descriptor = 0
+  /\ phase = "idle" /\ captured = 0 /\ floor = 0
+  /\ cache = 0 /\ result = 0 /\ crossed = FALSE /\ readOrphanRace = FALSE
+
+Upload(i) ==
+  /\ i \in {1, 2} /\ i \notin uploaded
+  /\ uploaded' = uploaded \cup {i}
+  /\ hint' = IF hint = 0 THEN i ELSE hint
+  /\ UNCHANGED <<winner, revision, descriptor, phase, captured, floor, cache,
+                 result, crossed, readOrphanRace>>
+
+(* Both imports used token 0: exactly one can publish, independently of
+   which immutable was uploaded first. The other candidate stays orphaned. *)
+Commit(i) ==
+  /\ i \in uploaded /\ revision = 0
+  /\ winner' = i /\ descriptor' = i /\ revision' = 1
+  /\ UNCHANGED <<uploaded, hint, phase, captured, floor, cache, result, crossed, readOrphanRace>>
+
+(* New committed snapshot, with distinguishable bytes at sequence 2. *)
+Advance ==
+  /\ revision = 1
+  /\ uploaded' = uploaded \cup {3} /\ descriptor' = 3 /\ revision' = 2
+  /\ UNCHANGED <<hint, winner, phase, captured, floor, cache, result, crossed, readOrphanRace>>
+
+Begin ==
+  /\ phase = "idle" /\ revision > 0
+  /\ captured' = IF Fault = "cache" /\ cache # 0 THEN cache ELSE descriptor
+  /\ floor' = revision /\ phase' = "data"
+  /\ UNCHANGED <<uploaded, hint, winner, revision, descriptor, cache, result, crossed, readOrphanRace>>
+
+ReadData ==
+  /\ phase = "data"
+  /\ LET key == CASE Fault = "guess" /\ floor = 1 -> hint
+                    [] Fault = "splice" -> descriptor
+                    [] OTHER -> captured
+     IN /\ result' = key /\ cache' = key
+  /\ crossed' = (crossed \/ floor < revision)
+  /\ readOrphanRace' = (readOrphanRace \/ (floor = 1 /\ hint # winner))
+  /\ phase' = "done"
+  /\ UNCHANGED <<uploaded, hint, winner, revision, descriptor, captured, floor>>
+
+Again ==
+  /\ phase = "done" /\ phase' = "idle"
+  /\ UNCHANGED <<uploaded, hint, winner, revision, descriptor, captured, floor,
+                 cache, result, crossed, readOrphanRace>>
+Crash ==
+  /\ cache # 0 /\ cache' = 0
+  /\ UNCHANGED <<uploaded, hint, winner, revision, descriptor, phase, captured,
+                 floor, result, crossed, readOrphanRace>>
+WorkNext == Advance \/ Begin \/ ReadData \/ Again \/ Crash
+        \/ \E i \in {1, 2} : Upload(i) \/ Commit(i)
+\* Make the stuttering already permitted by [][Next]_vars explicit to TLC.
+\* This adds no behavior to Spec and does not assert progress or deadlock freedom.
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+TypeOK ==
+  /\ uploaded \subseteq {1, 2, 3} /\ hint \in 0..2 /\ winner \in 0..2
+  /\ revision \in 0..2 /\ descriptor \in 0..3
+  /\ phase \in {"idle", "data", "done"}
+  /\ captured \in 0..3 /\ floor \in 0..2 /\ cache \in 0..3 /\ result \in 0..3
+  /\ crossed \in BOOLEAN /\ readOrphanRace \in BOOLEAN
+DescriptorDurable == revision > 0 => descriptor \in uploaded
+SnapshotAuthority ==
+  phase = "done" => result = IF floor = 1 THEN winner ELSE 3
+ReadFresh ==
+  phase = "data" => captured = IF floor = 1 THEN winner ELSE 3
+NoCrossedRead == ~crossed
+NoOrphanRaceRead == ~readOrphanRace
+=============================================================================
diff --git a/docs/spec/scratch/TempReclaim.tla b/docs/spec/scratch/TempReclaim.tla
new file mode 100644
index 0000000..f1c999a
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim.tla
@@ -0,0 +1,215 @@
+----------------------------- MODULE TempReclaim -----------------------------
+
+EXTENDS Naturals, FiniteSets, TLC
+
+CONSTANTS NoDropGuard, NoInterlock, AgeAuthority, NoDeadReclaim, NoSweep,
+          MaxPid,
+          MaxSeq
+
+Procs == {"p1", "p2"}
+Lanes == {"pub", "rdr"}
+PC    == {"idle", "swept", "writing"}
+Pids  == 1..MaxPid
+Seqs  == 0..(MaxSeq - 1)
+Bound == Cardinality(Procs) * Cardinality(Lanes)
+
+Temp(x, s) == [pid |-> x, seq |-> s]
+
+VARIABLES
+  alive,
+  pid,
+  past,
+  nextpid,
+  lane,
+  lseq,
+  nextseq,
+  inflight,
+  temps,
+  victim,
+  cancelled,
+  renamedOK,
+  sweptDead,
+  laneSweptDead,
+  sweptPastPeer
+vars == <<alive, pid, past, nextpid, lane, lseq, nextseq, inflight, temps,
+          victim, cancelled, renamedOK, sweptDead, laneSweptDead, sweptPastPeer>>
+ghosts == <<victim, cancelled, renamedOK, sweptDead, laneSweptDead, sweptPastPeer>>
+
+Live(x)     == \E q \in Procs : alive[q] /\ pid[q] = x
+Dead(x)     == ~Live(x)
+Writing(p)  == {l \in Lanes : lane[p][l] = "writing"}
+OwnedBy(x)  == {t \in temps : t.pid = x}
+
+Reclaimable(me, reg) ==
+  IF NoSweep THEN {}
+  ELSE {t \in temps :
+          \/ ~NoDeadReclaim /\ Dead(t.pid)
+          \/ t.pid = me /\ (NoInterlock \/ t.seq \notin reg)
+          \/ AgeAuthority /\ t.pid # me /\ Live(t.pid)}
+
+Init ==
+  /\ alive = [p \in Procs |-> TRUE]
+  /\ pid = [p \in Procs |-> IF p = "p1" THEN 1 ELSE 2]
+  /\ past = [p \in Procs |-> {}]
+  /\ nextpid = 3
+  /\ lane = [p \in Procs |-> [l \in Lanes |-> "idle"]]
+  /\ lseq = [p \in Procs |-> [l \in Lanes |-> 0]]
+  /\ nextseq = [p \in Procs |-> 0]
+  /\ inflight = [p \in Procs |-> {}]
+  /\ temps = {}
+  /\ victim = FALSE /\ cancelled = FALSE /\ renamedOK = FALSE
+  /\ sweptDead = FALSE /\ laneSweptDead = FALSE /\ sweptPastPeer = FALSE
+
+Sweep(p, l) ==
+  /\ alive[p] /\ lane[p][l] = "idle"
+  /\ LET r == Reclaimable(pid[p], inflight[p]) IN
+       /\ temps' = temps \ r
+       /\ sweptDead' = (sweptDead \/ \E t \in r : Dead(t.pid))
+       /\ laneSweptDead' = (laneSweptDead \/ \E t \in r : Dead(t.pid))
+       /\ sweptPastPeer' =
+            (sweptPastPeer \/ \E t \in temps \ r : t.pid # pid[p] /\ Live(t.pid))
+  /\ lane' = [lane EXCEPT ![p][l] = "swept"]
+  /\ UNCHANGED <<alive, pid, past, nextpid, lseq, nextseq, inflight,
+                 victim, cancelled, renamedOK>>
+
+Create(p, l) ==
+  /\ alive[p] /\ lane[p][l] = "swept" /\ nextseq[p] < MaxSeq
+  /\ LET s == nextseq[p] IN
+       /\ temps' = temps \cup {Temp(pid[p], s)}
+       /\ inflight' = [inflight EXCEPT ![p] = @ \cup {s}]
+       /\ lseq' = [lseq EXCEPT ![p][l] = s]
+       /\ nextseq' = [nextseq EXCEPT ![p] = s + 1]
+  /\ lane' = [lane EXCEPT ![p][l] = "writing"]
+  /\ UNCHANGED <<alive, pid, past, nextpid>> /\ UNCHANGED ghosts
+
+Rename(p, l) ==
+  /\ alive[p] /\ lane[p][l] = "writing"
+  /\ LET t == Temp(pid[p], lseq[p][l]) IN
+       /\ IF t \in temps
+          THEN temps' = temps \ {t} /\ renamedOK' = TRUE /\ victim' = victim
+          ELSE temps' = temps /\ victim' = TRUE /\ renamedOK' = renamedOK
+       /\ inflight' = [inflight EXCEPT ![p] = @ \ {lseq[p][l]}]
+  /\ lane' = [lane EXCEPT ![p][l] = "idle"]
+  /\ lseq' = [lseq EXCEPT ![p][l] = 0]
+  /\ UNCHANGED <<alive, pid, past, nextpid, nextseq,
+                 cancelled, sweptDead, laneSweptDead, sweptPastPeer>>
+
+Cancel(p, l) ==
+  /\ alive[p] /\ lane[p][l] = "writing"
+  /\ temps' = temps
+  /\ IF NoDropGuard
+     THEN inflight' = inflight
+     ELSE inflight' = [inflight EXCEPT ![p] = @ \ {lseq[p][l]}]
+  /\ cancelled' = TRUE
+  /\ lane' = [lane EXCEPT ![p][l] = "idle"]
+  /\ lseq' = [lseq EXCEPT ![p][l] = 0]
+  /\ UNCHANGED <<alive, pid, past, nextpid, nextseq,
+                 victim, renamedOK, sweptDead, laneSweptDead, sweptPastPeer>>
+
+Crash(p) ==
+  /\ alive[p]
+  /\ alive' = [alive EXCEPT ![p] = FALSE]
+  /\ inflight' = [inflight EXCEPT ![p] = {}]
+  /\ lane' = [lane EXCEPT ![p] = [l \in Lanes |-> "idle"]]
+  /\ lseq' = [lseq EXCEPT ![p] = [l \in Lanes |-> 0]]
+  /\ UNCHANGED <<pid, past, nextpid, nextseq, temps>> /\ UNCHANGED ghosts
+
+Restart(p) ==
+  /\ ~alive[p] /\ nextpid <= MaxPid
+  /\ LET r == Reclaimable(nextpid, {}) IN
+       /\ temps' = temps \ r
+       /\ sweptDead' = (sweptDead \/ \E t \in r : Dead(t.pid))
+       /\ sweptPastPeer' = (sweptPastPeer \/ \E t \in temps \ r : Live(t.pid))
+  /\ alive' = [alive EXCEPT ![p] = TRUE]
+  /\ past' = [past EXCEPT ![p] = @ \cup {pid[p]}]
+  /\ pid' = [pid EXCEPT ![p] = nextpid]
+  /\ nextpid' = nextpid + 1
+  /\ nextseq' = [nextseq EXCEPT ![p] = 0]
+  /\ UNCHANGED <<lane, lseq, inflight, victim, cancelled, renamedOK, laneSweptDead>>
+
+WorkNext ==
+  \/ \E p \in Procs, l \in Lanes :
+       Sweep(p, l) \/ Create(p, l) \/ Rename(p, l) \/ Cancel(p, l)
+  \/ \E p \in Procs : Crash(p) \/ Restart(p)
+
+Next == WorkNext \/ UNCHANGED vars
+
+Spec == Init /\ [][Next]_vars
+
+TypeOK ==
+  /\ alive \in [Procs -> BOOLEAN]
+  /\ pid \in [Procs -> Pids]
+  /\ past \in [Procs -> SUBSET Pids]
+  /\ nextpid \in 3..(MaxPid + 1)
+  /\ lane \in [Procs -> [Lanes -> PC]]
+  /\ lseq \in [Procs -> [Lanes -> Seqs]]
+  /\ nextseq \in [Procs -> 0..MaxSeq]
+  /\ inflight \in [Procs -> SUBSET Seqs]
+  /\ temps \in SUBSET [pid : Pids, seq : Seqs]
+
+BoundedLitter == Cardinality(temps) <= Bound
+
+NoLiveVictim == ~victim
+
+PidsOwned ==
+  /\ \A p \in Procs : pid[p] < nextpid /\ \A x \in past[p] : x < pid[p]
+  /\ \A p, q \in Procs : p # q =>
+       ({pid[p]} \cup past[p]) \cap ({pid[q]} \cup past[q]) = {}
+  /\ \A t \in temps : \E p \in Procs : t.pid = pid[p] \/ t.pid \in past[p]
+
+LaneShape ==
+  \A p \in Procs :
+    /\ inflight[p] = {lseq[p][l] : l \in Writing(p)}
+    /\ Cardinality(inflight[p]) = Cardinality(Writing(p))
+    /\ \A l \in Lanes : lane[p][l] = "writing" => lseq[p][l] < nextseq[p]
+    /\ \A l \in Lanes : lane[p][l] # "writing" => lseq[p][l] = 0
+    /\ ~alive[p] => inflight[p] = {} /\ Writing(p) = {}
+
+Registered(p) == {Temp(pid[p], s) : s \in inflight[p]}
+Leftover(p) == OwnedBy(pid[p]) \ Registered(p)
+Residue ==
+  \A p \in Procs :
+    /\ \A x \in past[p] : OwnedBy(x) = {}
+    /\ alive[p] =>
+         /\ Registered(p) \subseteq OwnedBy(pid[p])
+         /\ Cardinality(Leftover(p)) <= Cardinality({l \in Lanes : lane[p][l] = "idle"})
+    /\ ~alive[p] => Cardinality(OwnedBy(pid[p])) <= Cardinality(Lanes)
+
+IndInv == TypeOK /\ PidsOwned /\ LaneShape /\ Residue /\ BoundedLitter
+
+IndInit ==
+  /\ nextpid \in 3..(MaxPid + 1)
+  /\ alive \in [Procs -> BOOLEAN]
+  /\ pid \in [Procs -> Pids]
+  /\ \A p \in Procs : pid[p] < nextpid
+  /\ \A p, q \in Procs : p # q => pid[p] # pid[q]
+  /\ past \in [Procs -> SUBSET Pids]
+  /\ \A p \in Procs : \A x \in past[p] : x < pid[p]
+  /\ \A p, q \in Procs : p # q =>
+       ({pid[p]} \cup past[p]) \cap ({pid[q]} \cup past[q]) = {}
+  /\ lane \in [Procs -> [Lanes -> PC]]
+  /\ \A p \in Procs : ~alive[p] => Writing(p) = {}
+  /\ nextseq \in [Procs -> 0..MaxSeq]
+  /\ lseq \in [Procs -> [Lanes -> Seqs]]
+  /\ \A p \in Procs : \A l \in Lanes :
+       /\ lane[p][l] = "writing" => lseq[p][l] < nextseq[p]
+       /\ lane[p][l] # "writing" => lseq[p][l] = 0
+  /\ \A p \in Procs : \A l, m \in Lanes :
+       l # m /\ lane[p][l] = "writing" /\ lane[p][m] = "writing" =>
+         lseq[p][l] # lseq[p][m]
+  /\ inflight = [p \in Procs |-> {lseq[p][l] : l \in Writing(p)}]
+  /\ temps \in SUBSET [pid : Pids, seq : Seqs]
+  /\ PidsOwned /\ Residue
+  /\ victim = FALSE /\ cancelled = FALSE /\ renamedOK = FALSE
+  /\ sweptDead = FALSE /\ laneSweptDead = FALSE /\ sweptPastPeer = FALSE
+
+NoDeadReclaimRecovery == ~(sweptDead /\ renamedOK)
+
+NoCancelRecovery == ~(cancelled /\ renamedOK)
+
+NoFullOccupancy == ~(\A p \in Procs : alive[p] /\ Writing(p) = Lanes)
+
+NoLaneReclaim == ~laneSweptDead
+
+NoSweepPastPeer == ~sweptPastPeer
+===============================================================================
diff --git a/docs/spec/scratch/TempReclaim_age_authority.cfg b/docs/spec/scratch/TempReclaim_age_authority.cfg
new file mode 100644
index 0000000..55962c8
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_age_authority.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = TRUE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoLiveVictim
+INVARIANT TypeOK
diff --git a/docs/spec/scratch/TempReclaim_fixed.cfg b/docs/spec/scratch/TempReclaim_fixed.cfg
new file mode 100644
index 0000000..f9ce3a4
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_fixed.cfg
@@ -0,0 +1,13 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT TypeOK
+INVARIANT BoundedLitter
+INVARIANT NoLiveVictim
+INVARIANT IndInv
diff --git a/docs/spec/scratch/TempReclaim_inductive.cfg b/docs/spec/scratch/TempReclaim_inductive.cfg
new file mode 100644
index 0000000..3fc2e2b
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_inductive.cfg
@@ -0,0 +1,11 @@
+INIT IndInit
+NEXT Next
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 4
+    MaxSeq = 2
+INVARIANT IndInv
diff --git a/docs/spec/scratch/TempReclaim_no_dead_reclaim.cfg b/docs/spec/scratch/TempReclaim_no_dead_reclaim.cfg
new file mode 100644
index 0000000..51f5f03
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_no_dead_reclaim.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = TRUE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT BoundedLitter
+INVARIANT TypeOK
diff --git a/docs/spec/scratch/TempReclaim_no_drop_guard.cfg b/docs/spec/scratch/TempReclaim_no_drop_guard.cfg
new file mode 100644
index 0000000..0520d99
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_no_drop_guard.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = TRUE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT BoundedLitter
+INVARIANT TypeOK
diff --git a/docs/spec/scratch/TempReclaim_no_interlock.cfg b/docs/spec/scratch/TempReclaim_no_interlock.cfg
new file mode 100644
index 0000000..7a6003b
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_no_interlock.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = TRUE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoLiveVictim
+INVARIANT TypeOK
diff --git a/docs/spec/scratch/TempReclaim_no_sweep.cfg b/docs/spec/scratch/TempReclaim_no_sweep.cfg
new file mode 100644
index 0000000..2756ae9
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_no_sweep.cfg
@@ -0,0 +1,11 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = TRUE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT BoundedLitter
+INVARIANT TypeOK
diff --git a/docs/spec/scratch/TempReclaim_w_cancel.cfg b/docs/spec/scratch/TempReclaim_w_cancel.cfg
new file mode 100644
index 0000000..c0f37c7
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_w_cancel.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoCancelRecovery
diff --git a/docs/spec/scratch/TempReclaim_w_dead.cfg b/docs/spec/scratch/TempReclaim_w_dead.cfg
new file mode 100644
index 0000000..121bd63
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_w_dead.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoDeadReclaimRecovery
diff --git a/docs/spec/scratch/TempReclaim_w_full.cfg b/docs/spec/scratch/TempReclaim_w_full.cfg
new file mode 100644
index 0000000..5d86775
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_w_full.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoFullOccupancy
diff --git a/docs/spec/scratch/TempReclaim_w_lane.cfg b/docs/spec/scratch/TempReclaim_w_lane.cfg
new file mode 100644
index 0000000..39ba97d
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_w_lane.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoLaneReclaim
diff --git a/docs/spec/scratch/TempReclaim_w_peer.cfg b/docs/spec/scratch/TempReclaim_w_peer.cfg
new file mode 100644
index 0000000..5f2d159
--- /dev/null
+++ b/docs/spec/scratch/TempReclaim_w_peer.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    NoDropGuard = FALSE
+    NoInterlock = FALSE
+    AgeAuthority = FALSE
+    NoDeadReclaim = FALSE
+    NoSweep = FALSE
+    MaxPid = 6
+    MaxSeq = 3
+INVARIANT NoSweepPastPeer
diff --git a/docs/spec/scratch/WALCheckpoint.tla b/docs/spec/scratch/WALCheckpoint.tla
new file mode 100644
index 0000000..eefb11f
--- /dev/null
+++ b/docs/spec/scratch/WALCheckpoint.tla
@@ -0,0 +1,136 @@
+-------------------------- MODULE WALCheckpoint --------------------------
+(***************************************************************************)
+(* Manifest-CAS commit protocol for walgit, focused on the checkpoint /    *)
+(* log-trim interaction (audit finding C2).                                *)
+(*                                                                          *)
+(* The bucket's `manifest.pb` is the single linearization point.  A        *)
+(* checkpoint folds the log up to some seq S: it sets checkpoint.seq = S,   *)
+(* min_seq = S+1, and drops every log segment whose last_seq <= S.  The     *)
+(* commit is a compare-and-swap on the manifest version token (`revision`). *)
+(*                                                                          *)
+(* Abstraction: segments always cover [segLo, head] contiguously (they are  *)
+(* appended contiguously in practice), so the whole live segment set is the *)
+(* single number `segLo`.  `rev` is both the monotone revision and the CAS  *)
+(* token: `myVer[i] = rev` means "no manifest write since instance i read". *)
+(*                                                                          *)
+(* Fix (a CONSTANT): FALSE models the historical bug, which only returns    *)
+(* when cpSeq >= head. TRUE models the fixed guard: also return when the   *)
+(* fresh checkpoint has reached the sequence this writer already            *)
+(* materialized.                                                            *)
+(* The intended sequence is never recomputed: its immutable candidate is    *)
+(* already bound to that sequence and attempt.                              *)
+(***************************************************************************)
+EXTENDS Naturals, FiniteSets, TLC
+
+CONSTANTS Instances, MaxSeq, Fix
+
+VARIABLES
+    head,     \* manifest head_seq
+    cpSeq,    \* manifest checkpoint.seq (0 = no checkpoint yet)
+    minSeq,   \* manifest min_seq
+    segLo,    \* lowest seq still covered by a live log segment
+    rev,      \* manifest revision == CAS version token (monotone)
+    phase,    \* [Instances -> {"idle","wrote"}]
+    myVer,    \* [Instances -> Nat] manifest version each instance last read
+    mySeq     \* [Instances -> Nat] fold seq each instance intends to commit
+
+vars == <<head, cpSeq, minSeq, segLo, rev, phase, myVer, mySeq>>
+
+Init ==
+    /\ head   = 1
+    /\ cpSeq  = 0
+    /\ minSeq = 1
+    /\ segLo  = 1
+    /\ rev    = 1
+    /\ phase  = [i \in Instances |-> "idle"]
+    /\ myVer  = [i \in Instances |-> 0]
+    /\ mySeq  = [i \in Instances |-> 0]
+
+(* A background push (or compact) appends one entry and bumps head + rev.    *)
+(* Segments still start at segLo, so segLo is unchanged.                     *)
+Push ==
+    /\ head < MaxSeq
+    /\ head' = head + 1
+    /\ rev'  = rev + 1
+    /\ UNCHANGED <<cpSeq, minSeq, segLo, phase, myVer, mySeq>>
+
+(* Round 1 of a checkpoint on instance i: read the manifest, write the       *)
+(* immutable checkpoint + refs objects (no manifest mutation yet), and       *)
+(* remember (version read, seq to fold to = current head).                   *)
+CkStart(i) ==
+    /\ phase[i] = "idle"
+    /\ head > cpSeq
+    /\ phase' = [phase EXCEPT ![i] = "wrote"]
+    /\ myVer' = [myVer EXCEPT ![i] = rev]
+    /\ mySeq' = [mySeq EXCEPT ![i] = head]
+    /\ UNCHANGED <<head, cpSeq, minSeq, segLo, rev>>
+
+(* Round 2 idempotency/anti-regression guard. The second disjunct is the fix:*)
+(*   if cpSeq >= mySeq[i] || cpSeq >= head { return }                        *)
+CkCommitIdem(i) ==
+    /\ phase[i] = "wrote"
+    /\ \/ cpSeq >= head
+       \/ /\ Fix
+          /\ cpSeq >= mySeq[i]
+    /\ phase' = [phase EXCEPT ![i] = "idle"]
+    /\ UNCHANGED <<head, cpSeq, minSeq, segLo, rev, myVer, mySeq>>
+
+(* Round 2, CAS succeeds (our read is still current).  Commit the fold at     *)
+(* mySeq[i] -- STALE under the bug.  Trim: segments with last_seq <= s are    *)
+(* dropped, so segLo rises to s+1 only when s+1 exceeds the current segLo.    *)
+CkCommitOk(i) ==
+    /\ phase[i] = "wrote"
+    /\ cpSeq < head
+    /\ (~Fix \/ cpSeq < mySeq[i])
+    /\ myVer[i] = rev
+    /\ LET s == mySeq[i] IN
+         /\ cpSeq'  = s
+         /\ minSeq' = s + 1
+         /\ segLo'  = IF s + 1 > segLo THEN s + 1 ELSE segLo
+         /\ rev'    = rev + 1
+    /\ phase' = [phase EXCEPT ![i] = "idle"]
+    /\ UNCHANGED <<head, myVer, mySeq>>
+
+(* Round 2, CAS fails (412): someone wrote since our read. Re-read the        *)
+(* version and retry without changing mySeq; the anti-regression guard is    *)
+(* re-evaluated against the fresh cpSeq before either retry action can fire. *)
+CkCommitRetry(i) ==
+    /\ phase[i] = "wrote"
+    /\ cpSeq < head
+    /\ (~Fix \/ cpSeq < mySeq[i])
+    /\ myVer[i] # rev
+    /\ myVer' = [myVer EXCEPT ![i] = rev]
+    /\ UNCHANGED <<head, cpSeq, minSeq, segLo, rev, phase, mySeq>>
+
+WorkNext ==
+    \/ Push
+    \/ \E i \in Instances :
+         CkStart(i) \/ CkCommitIdem(i) \/ CkCommitOk(i) \/ CkCommitRetry(i)
+
+Next == WorkNext \/ UNCHANGED vars
+Spec == Init /\ [][Next]_vars
+
+(***************************************************************************)
+(* Invariants.                                                              *)
+(***************************************************************************)
+
+(* Contiguous reference only. Public segments may contain burned gaps and
+   genesis is special: use proto invariants, not this equality, in Rust. *)
+SegAtMin == segLo = minSeq
+
+(* Proto: min_seq == checkpoint.seq + 1 when a checkpoint exists.           *)
+MinIsCp == (cpSeq = 0) \/ (minSeq = cpSeq + 1)
+
+(* Durability / read-your-writes: every committed seq in 1..head is         *)
+(* reconstructable = folded into the checkpoint (<= cpSeq) OR still in a     *)
+(* live segment (>= segLo).  A gap here is silent data loss on cold start.  *)
+NoGap == segLo <= cpSeq + 1
+
+CpBounded == cpSeq <= head
+
+TypeOK ==
+    /\ head   \in 0..MaxSeq
+    /\ cpSeq  \in 0..MaxSeq
+    /\ minSeq \in 1..(MaxSeq + 1)
+    /\ segLo  \in 1..(MaxSeq + 1)
+=============================================================================
diff --git a/docs/spec/scratch/WALCheckpoint_bug.cfg b/docs/spec/scratch/WALCheckpoint_bug.cfg
new file mode 100644
index 0000000..765a921
--- /dev/null
+++ b/docs/spec/scratch/WALCheckpoint_bug.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    Instances = {i1, i2}
+    MaxSeq = 4
+    Fix = FALSE
+INVARIANT TypeOK
+INVARIANT SegAtMin
+INVARIANT MinIsCp
+INVARIANT NoGap
+INVARIANT CpBounded
diff --git a/docs/spec/scratch/WALCheckpoint_fix.cfg b/docs/spec/scratch/WALCheckpoint_fix.cfg
new file mode 100644
index 0000000..ed26ab9
--- /dev/null
+++ b/docs/spec/scratch/WALCheckpoint_fix.cfg
@@ -0,0 +1,10 @@
+SPECIFICATION Spec
+CONSTANTS
+    Instances = {i1, i2}
+    MaxSeq = 4
+    Fix = TRUE
+INVARIANT TypeOK
+INVARIANT SegAtMin
+INVARIANT MinIsCp
+INVARIANT NoGap
+INVARIANT CpBounded
diff --git a/docs/spec/tlc/MC.cfg b/docs/spec/tlc/MC.cfg
new file mode 100644
index 0000000..0b6280a
--- /dev/null
+++ b/docs/spec/tlc/MC.cfg
@@ -0,0 +1,37 @@
+\* Run (a): safety, Trim ENABLED (singleton sets), ProvenanceAll NOT checked.
+SPECIFICATION MCSpecTrimSafety
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA, rB}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1, c2}
+  Instances = {i1, i2}
+  MaxPushes = 3
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- MCTxnPool
+SYMMETRY Symm
+INVARIANTS
+  TypeOK
+  AckedCommitted
+  HistPreconds
+  ClosureLive
+  NoPhantomPush
+PROPERTIES
+  Mono
+  ReadFresh
+  AckAfterCommit
diff --git a/docs/spec/tlc/MC.tla b/docs/spec/tlc/MC.tla
new file mode 100644
index 0000000..eece03e
--- /dev/null
+++ b/docs/spec/tlc/MC.tla
@@ -0,0 +1,62 @@
+------------------------------- MODULE MC -------------------------------
+(***************************************************************************)
+(* Bounded model-checking harness for WALContract.    *)
+(* Every model-side adaptation lives HERE, never in WALContract.tla:      *)
+(*   - Trim restricted to singleton sets (TrimSets) via MCNextTrim, as    *)
+(*     4e prescribes ("restrict Trim to singleton S in the first model"); *)
+(*   - a Trim-disabled next-state relation (MCNextNoTrim) for the T15     *)
+(*     dichotomy run that adds ProvenanceAll;                             *)
+(*   - concrete Reach / TxnPool values (TLC's :> and @@);                 *)
+(*   - safety specs WITHOUT Fairness (the module says safety needs none), *)
+(*     and MCSpecLive with the module's own Fairness for liveness;        *)
+(*   - Symm for SYMMETRY on Clients/Instances (safety runs only:          *)
+(*     symmetry is unsound under liveness checking).                      *)
+(***************************************************************************)
+EXTENDS WALContract, TLC
+
+CONSTANTS rA, rB, v1, v2, v3, o1, o2, o3, o4, c1, c2, i1, i2
+
+\* 4e: shared o1 exercises the trim guards.
+MCReach ==
+  (None :> {}) @@ (v1 :> {o1}) @@ (v2 :> {o1, o2}) @@ (v3 :> {o1, o3})
+
+\* 4e: the 5 candidate transactions.
+MCTxnPool ==
+  { [refs |-> {rA},     old |-> (rA :> None),              \* create
+                        new |-> (rA :> v1), provides |-> {o1}],
+    [refs |-> {rA},     old |-> (rA :> v1),                \* dependent update
+                        new |-> (rA :> v2), provides |-> {o2}],
+    [refs |-> {rA},     old |-> (rA :> v1),                \* sibling conflict
+                        new |-> (rA :> v3), provides |-> {o3}],
+    [refs |-> {rB},     old |-> (rB :> None),              \* independent ref
+                        new |-> (rB :> v1), provides |-> {o1}],
+    [refs |-> {rA, rB}, old |-> (rA :> v1) @@ (rB :> v1),  \* multi-ref submission
+                        new |-> (rA :> v2) @@ (rB :> v2), provides |-> {o2}] }
+
+TrimSets == { {o} : o \in Objs }
+
+MCNextTrim ==
+  \/ \E c \in Clients : PushBegin(c) \/ ReadBegin(c)
+  \/ \E c \in Clients, i \in Instances : ReadEnd(c, i)
+  \/ \E id \in DOMAIN pend :
+       Upload(id) \/ CommitPush(id) \/ NackPush(id)
+                  \/ AckPush(id)    \/ LoseAck(id)
+  \/ Fold
+  \/ \E S \in TrimSets : Trim(S)
+  \/ \E i \in Instances : Crash(i)
+
+MCNextNoTrim ==
+  \/ \E c \in Clients : PushBegin(c) \/ ReadBegin(c)
+  \/ \E c \in Clients, i \in Instances : ReadEnd(c, i)
+  \/ \E id \in DOMAIN pend :
+       Upload(id) \/ CommitPush(id) \/ NackPush(id)
+                  \/ AckPush(id)    \/ LoseAck(id)
+  \/ Fold
+  \/ \E i \in Instances : Crash(i)
+
+MCSpecTrimSafety   == Init /\ [][MCNextTrim]_vars     \* run (a)
+MCSpecNoTrimSafety == Init /\ [][MCNextNoTrim]_vars   \* run (b) + ProvenanceAll
+MCSpecLive         == Init /\ [][MCNextTrim]_vars /\ Fairness
+
+Symm == Permutations(Clients) \cup Permutations(Instances)
+=============================================================================
diff --git a/docs/spec/tlc/MCTrim.cfg b/docs/spec/tlc/MCTrim.cfg
new file mode 100644
index 0000000..8d71c44
--- /dev/null
+++ b/docs/spec/tlc/MCTrim.cfg
@@ -0,0 +1,37 @@
+SPECIFICATION TrimSpec
+CONSTANTS
+  Fault = "none"
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1}
+  Instances = {i1}
+  MaxPushes = 2
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- TrimTxnPool
+INVARIANTS
+  TypeOK
+  AckedCommitted
+  HistPreconds
+  ClosureLive
+  NoPhantomPush
+  ReadCompletable
+PROPERTIES
+  Mono
+  ReadFresh
+  AckAfterCommit
diff --git a/docs/spec/tlc/MCTrim.tla b/docs/spec/tlc/MCTrim.tla
new file mode 100644
index 0000000..8cd8dc3
--- /dev/null
+++ b/docs/spec/tlc/MCTrim.tla
@@ -0,0 +1,29 @@
+----------------------------- MODULE MCTrim -----------------------------
+(* Focused reference harness: unlike the original pool, a delete can make
+   already-published objects collectible. Check the full active-read window,
+   not only ClosureLive at the latest tip. No changes to WALContract. *)
+EXTENDS MC
+CONSTANT Fault
+ASSUME Fault \in {"none", "reader"}
+TrimTxnPool ==
+  { [refs |-> {rA}, old |-> (rA :> None), new |-> (rA :> v2), provides |-> {o1, o2}],
+    [refs |-> {rA}, old |-> (rA :> v2), new |-> (rA :> None), provides |-> {}] }
+TrimWithoutReader(S) ==
+  /\ S \subseteq live /\ S # {}
+  /\ S \cap Needed(Len(hist)) = {}
+  /\ \A id \in DOMAIN pend : pend[id].stage = "up" => S \cap NeedOf(pend[id].txn) = {}
+  /\ live' = live \ S
+  /\ UNCHANGED <<hist, acked, objs, pend, nextId, rd, obs, view>>
+TrimNext ==
+  \/ \E c \in Clients : PushBegin(c) \/ ReadBegin(c)
+  \/ \E c \in Clients, i \in Instances : ReadEnd(c, i)
+  \/ \E id \in DOMAIN pend : Upload(id) \/ CommitPush(id) \/ NackPush(id) \/ AckPush(id) \/ LoseAck(id)
+  \/ Fold
+  \/ \E S \in SUBSET Objs : IF Fault = "reader" THEN TrimWithoutReader(S) ELSE Trim(S)
+  \/ \E i \in Instances : Crash(i)
+TrimSpec == Init /\ [][TrimNext]_vars
+ReadCompletable ==
+  \A c \in Clients : rd[c].act =>
+    \A j \in rd[c].lo..Len(hist) : Needed(j) \subseteq live
+NoHistoricalTrim == ProvenanceAll
+=============================================================================
diff --git a/docs/spec/tlc/MC_bug.cfg b/docs/spec/tlc/MC_bug.cfg
new file mode 100644
index 0000000..fb0162c
--- /dev/null
+++ b/docs/spec/tlc/MC_bug.cfg
@@ -0,0 +1,30 @@
+\* NEGATIVE CONTROL: same model as MC.cfg run (a) except CommitPush lost
+\* its per-ref old-value check. Expect: HistPreconds VIOLATED.
+SPECIFICATION MCSpecBug
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA, rB}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1, c2}
+  Instances = {i1, i2}
+  MaxPushes = 3
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- MCTxnPool
+SYMMETRY Symm
+INVARIANTS
+  HistPreconds
diff --git a/docs/spec/tlc/MC_bug.tla b/docs/spec/tlc/MC_bug.tla
new file mode 100644
index 0000000..a54025c
--- /dev/null
+++ b/docs/spec/tlc/MC_bug.tla
@@ -0,0 +1,29 @@
+----------------------------- MODULE MC_bug -----------------------------
+(***************************************************************************)
+(* NEGATIVE CONTROL. Deliberately weakened model: MCCommitPushBug is      *)
+(* CommitPush WITHOUT the per-ref old-value CAS check (T4). Everything    *)
+(* else is identical to MC's run (a). HistPreconds MUST fail here; a      *)
+(* suite that cannot fail proves nothing. Never merge this into MC.tla.  *)
+(***************************************************************************)
+EXTENDS MC
+
+MCCommitPushBug(id) ==
+  /\ id \in DOMAIN pend /\ pend[id].stage = "up"
+  \* BUG: per-ref old-value CAS check (T4) deleted here.
+  /\ NeedOf(pend[id].txn) \subseteq live
+  /\ hist' = Append(hist, [kind |-> "push", id |-> id, txn |-> pend[id].txn])
+  /\ pend' = [pend EXCEPT ![id].stage = "cmt"]
+  /\ UNCHANGED <<acked, objs, live, nextId, rd, obs, view>>
+
+MCNextBug ==
+  \/ \E c \in Clients : PushBegin(c) \/ ReadBegin(c)
+  \/ \E c \in Clients, i \in Instances : ReadEnd(c, i)
+  \/ \E id \in DOMAIN pend :
+       Upload(id) \/ MCCommitPushBug(id) \/ NackPush(id)
+                  \/ AckPush(id)         \/ LoseAck(id)
+  \/ Fold
+  \/ \E S \in TrimSets : Trim(S)
+  \/ \E i \in Instances : Crash(i)
+
+MCSpecBug == Init /\ [][MCNextBug]_vars
+=============================================================================
diff --git a/docs/spec/tlc/MC_fast.cfg b/docs/spec/tlc/MC_fast.cfg
new file mode 100644
index 0000000..4b9aa84
--- /dev/null
+++ b/docs/spec/tlc/MC_fast.cfg
@@ -0,0 +1,37 @@
+\* Fast arm for `just spec`: run (a) at MaxPushes=2 (seconds, not minutes).
+SPECIFICATION MCSpecTrimSafety
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA, rB}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1, c2}
+  Instances = {i1, i2}
+  MaxPushes = 2
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- MCTxnPool
+SYMMETRY Symm
+INVARIANTS
+  TypeOK
+  AckedCommitted
+  HistPreconds
+  ClosureLive
+  NoPhantomPush
+PROPERTIES
+  Mono
+  ReadFresh
+  AckAfterCommit
diff --git a/docs/spec/tlc/MC_incomplete.cfg b/docs/spec/tlc/MC_incomplete.cfg
new file mode 100644
index 0000000..1d3c55f
--- /dev/null
+++ b/docs/spec/tlc/MC_incomplete.cfg
@@ -0,0 +1,26 @@
+SPECIFICATION MCSpecLive
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1}
+  Instances = {i1}
+  MaxPushes = 1
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- IncompleteTxnPool
+PROPERTY PushTerminates
diff --git a/docs/spec/tlc/MC_incomplete.tla b/docs/spec/tlc/MC_incomplete.tla
new file mode 100644
index 0000000..80de594
--- /dev/null
+++ b/docs/spec/tlc/MC_incomplete.tla
@@ -0,0 +1,10 @@
+-------------------------- MODULE MC_incomplete --------------------------
+(* Boundary counterexample, NOT a production regression. WALContract permits
+   provides={} in its assumptions but has no missing-object rejection action.
+   Its fairness cannot enable CommitPush or NackPush for this request. Never
+   cite the original finite valid pool's liveness pass as universal liveness.
+   BatchPublication's missing scenario models the required refusal instead. *)
+EXTENDS MC
+IncompleteTxnPool ==
+  {[refs |-> {rA}, old |-> (rA :> None), new |-> (rA :> v1), provides |-> {}]}
+=============================================================================
diff --git a/docs/spec/tlc/MC_live.cfg b/docs/spec/tlc/MC_live.cfg
new file mode 100644
index 0000000..859cb01
--- /dev/null
+++ b/docs/spec/tlc/MC_live.cfg
@@ -0,0 +1,31 @@
+\* Liveness run: module's Fairness, NO SYMMETRY (unsound under liveness).
+\* Trim stays enabled (singleton sets) - it has no fairness, may happen or not.
+SPECIFICATION MCSpecLive
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA, rB}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1, c2}
+  Instances = {i1, i2}
+  MaxPushes = 2
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- MCTxnPool
+PROPERTIES
+  PushTerminates
+  ReadsTerminate
+  EventuallyFolded
diff --git a/docs/spec/tlc/MC_notrim.cfg b/docs/spec/tlc/MC_notrim.cfg
new file mode 100644
index 0000000..4efd310
--- /dev/null
+++ b/docs/spec/tlc/MC_notrim.cfg
@@ -0,0 +1,38 @@
+\* Run (b): safety, Trim DISABLED, ProvenanceAll ADDED (T15 dichotomy, Q2).
+SPECIFICATION MCSpecNoTrimSafety
+CONSTANTS
+  rA = rA
+  rB = rB
+  v1 = v1
+  v2 = v2
+  v3 = v3
+  o1 = o1
+  o2 = o2
+  o3 = o3
+  o4 = o4
+  c1 = c1
+  c2 = c2
+  i1 = i1
+  i2 = i2
+  None = None
+  Refs = {rA, rB}
+  Vals = {None, v1, v2, v3}
+  Objs = {o1, o2, o3, o4}
+  Clients = {c1, c2}
+  Instances = {i1, i2}
+  MaxPushes = 3
+  FoldBound = 1
+  Reach <- MCReach
+  TxnPool <- MCTxnPool
+SYMMETRY Symm
+INVARIANTS
+  TypeOK
+  AckedCommitted
+  HistPreconds
+  ClosureLive
+  NoPhantomPush
+  ProvenanceAll
+PROPERTIES
+  Mono
+  ReadFresh
+  AckAfterCommit
diff --git a/docs/spec/tlc/cases.tsv b/docs/spec/tlc/cases.tsv
new file mode 100644
index 0000000..4b2f9a9
--- /dev/null
+++ b/docs/spec/tlc/cases.tsv
@@ -0,0 +1,167 @@
+# name module config scenario fault specification expected
+reference-incomplete MC_incomplete MC_incomplete - - - temporal:PushTerminates
+reader-trim MCTrim MCTrim - none - pass
+bug-reader-trim MCTrim MCTrim - reader - ReadCompletable
+witness-historical-trim MCTrim MCTrim - none - NoHistoricalTrim
+publication-view-fixed PublicationView PublicationView_fix - - - pass
+publication-view-bug PublicationView PublicationView_bug - - - NoLostUpdate
+snapshot SnapshotAuthority SnapshotAuthority - none Spec pass
+bug-snapshot-guess SnapshotAuthority SnapshotAuthority - guess Spec SnapshotAuthority
+bug-snapshot-splice SnapshotAuthority SnapshotAuthority - splice Spec SnapshotAuthority
+bug-snapshot-cache SnapshotAuthority SnapshotAuthority - cache Spec ReadFresh
+witness-snapshot-crossed SnapshotAuthority SnapshotAuthority - none Spec NoCrossedRead
+witness-snapshot-orphan SnapshotAuthority SnapshotAuthority - none Spec NoOrphanRaceRead
+coverage PackCoverage PackCoverage - none Spec pass
+bug-coverage-retire PackCoverage PackCoverage - retire Spec BindingSound
+bug-coverage-scope PackCoverage PackCoverage - scope Spec BindingSound
+bug-coverage-policy PackCoverage PackCoverage - policy Spec OfferScoped
+bug-coverage-dependency PackCoverage PackCoverage - dependency Spec CompleteFetch
+bug-coverage-generation PackCoverage PackCoverage - generation Spec CompleteFetch
+bug-coverage-companion PackCoverage PackCoverage - companion Spec CompleteFetch
+witness-coverage-retry PackCoverage PackCoverage - none Spec NoRetryBind
+witness-coverage-old-tip PackCoverage PackCoverage - none Spec NoOldTipOffer
+witness-coverage-new-tip PackCoverage PackCoverage - none Spec NoCompleteNewOffer
+witness-coverage-concurrent PackCoverage PackCoverage - none Spec NoConcurrentOffer
+replacement-conserve PackReplacement PackReplacement healthy-conserve none Spec pass
+replacement-broken PackReplacement PackReplacement broken-conserve none Spec pass
+replacement-prune PackReplacement PackReplacement healthy-prune none Spec pass
+replacement-prune-broken PackReplacement PackReplacement broken-prune none Spec pass
+bug-replacement-raw PackReplacement PackReplacement broken-conserve raw Spec AdmissionSound
+bug-replacement-conserve PackReplacement PackReplacement healthy-conserve conserve Spec Conserves
+bug-replacement-overwrite PackReplacement PackReplacement healthy-conserve replace Spec Servable
+bug-replacement-supersedes PackReplacement PackReplacement healthy-conserve supersedes Spec Servable
+witness-replacement-seal PackReplacement PackReplacement healthy-conserve none Spec NoSeal
+witness-replacement-refuse PackReplacement PackReplacement broken-conserve none Spec NoRejectedInput
+witness-replacement-prune PackReplacement PackReplacement broken-prune none Spec NoSeal
+witness-replacement-race PackReplacement PackReplacement healthy-conserve none Spec NoRacingSeal
+witness-replacement-retry PackReplacement PackReplacement healthy-conserve none Spec NoRetrySeal
+closure-provenance-fixed ClosureProvenance ClosureProvenance_fix - - - pass
+closure-provenance-bug ClosureProvenance ClosureProvenance_bug - - - ServableClosure
+closure-provenance-stale-guard ClosureProvenance ClosureProvenance_stale - - - ServableClosure
+closure-provenance-stale-seal ClosureProvenance ClosureProvenance_stale_seal - - - ServableClosure
+closure-provenance-stale-retry ClosureProvenance ClosureProvenance_stale_retry - - - ServableClosure
+closure-provenance-no-tip-guard ClosureProvenance ClosureProvenance_no_tip - - - ServableClosure
+witness-closure-refusal ClosureProvenance ClosureProvenance_fix - - - NoRefusal
+witness-closure-commit ClosureProvenance ClosureProvenance_fix - - - NoCommit
+witness-closure-retry-commit ClosureProvenance ClosureProvenance_fix - - - NoRetryCommit
+witness-closure-replan ClosureProvenance ClosureProvenance_fix - - - NoReplan
+closure-provenance-rival ClosureProvenance ClosureProvenance_rival - - - pass
+witness-closure-undercut ClosureProvenance ClosureProvenance_rival - - - NoUndercut
+front-replay-fixed FrontReplay FrontReplay_fix - - - pass
+front-replay-on-ambiguous FrontReplay FrontReplay_replay_ambiguous - - - NoLaunderedRejection
+front-replay-connect-signal-lies FrontReplay FrontReplay_connect_lies - - - NoLaunderedRejection
+front-replay-no-precondition FrontReplay FrontReplay_no_precondition - - - AtMostOnce
+front-replay-noop-publishes FrontReplay FrontReplay_noop_publishes - - - AtMostOneEntry
+witness-front-replay-fallback FrontReplay FrontReplay_fix - - - NoFallbackApply
+witness-front-replay-recovery FrontReplay FrontReplay_fix - - - NoAmbiguousRecovery
+witness-front-replay-duplicate FrontReplay FrontReplay_fix - - - NoDuplicateRejected
+witness-front-replay-confusion FrontReplay FrontReplay_fix - - - NoHonestConfusion
+witness-front-replay-quiet-noop FrontReplay FrontReplay_fix - - - NoQuietNoOp
+checkpoint-fixed WALCheckpoint WALCheckpoint_fix - - - pass
+checkpoint-bug WALCheckpoint WALCheckpoint_bug - - - SegAtMin
+batch-race BatchPublication BatchPublication race none Spec pass
+batch-denied BatchPublication BatchPublication denied none Spec pass
+batch-missing BatchPublication BatchPublication missing none Spec pass
+batch-policy BatchPublication BatchPublication policy none Spec pass
+batch-dependent BatchPublication BatchPublication dependent none Spec pass
+batch-delete BatchPublication BatchPublication delete none Spec pass
+batch-noop BatchPublication BatchPublication noop none Spec pass
+batch-rejected-noop BatchPublication BatchPublication rejectednoop none Spec pass
+live-race BatchPublication BatchPublication race none LiveSpec pass
+live-denied BatchPublication BatchPublication denied none LiveSpec pass
+live-missing BatchPublication BatchPublication missing none LiveSpec pass
+live-policy BatchPublication BatchPublication policy none LiveSpec pass
+live-dependent BatchPublication BatchPublication dependent none LiveSpec pass
+live-delete BatchPublication BatchPublication delete none LiveSpec pass
+live-noop BatchPublication BatchPublication noop none LiveSpec pass
+live-rejected-noop BatchPublication BatchPublication rejectednoop none LiveSpec pass
+healthy-race BatchPublication BatchPublication race none HealthySpec pass
+healthy-denied BatchPublication BatchPublication denied none HealthySpec pass
+healthy-missing BatchPublication BatchPublication missing none HealthySpec pass
+healthy-policy BatchPublication BatchPublication policy none HealthySpec pass
+healthy-dependent BatchPublication BatchPublication dependent none HealthySpec pass
+healthy-delete BatchPublication BatchPublication delete none HealthySpec pass
+healthy-noop BatchPublication BatchPublication noop none HealthySpec pass
+healthy-rejected-noop BatchPublication BatchPublication rejectednoop none HealthySpec pass
+bug-retry BatchPublication BatchPublication race retry Spec CommitPreconditions
+bug-partial BatchPublication BatchPublication denied partial Spec SubmissionAtomic
+bug-policy BatchPublication BatchPublication policy policy Spec DecisionIsolation
+bug-isolation BatchPublication BatchPublication denied isolation Spec DecisionIsolation
+bug-early-ack BatchPublication BatchPublication race earlyack Spec ReportsTruthful
+bug-phantom-ok BatchPublication BatchPublication denied phantom Spec ReportsTruthful
+bug-absence BatchPublication BatchPublication race absence Spec ReportsTruthful
+bug-noop-phantom BatchPublication BatchPublication noop noopphantom Spec NoopReceiptTruthful
+bug-unfair BatchPublication BatchPublication race none Spec temporal:Terminates
+witness-retry BatchPublication BatchPublication dependent none Spec NoRetryCommit
+witness-late BatchPublication BatchPublication race none Spec NoLateCommit
+witness-folded BatchPublication BatchPublication race none Spec NoFoldedUnknown
+witness-atomic BatchPublication BatchPublication race none Spec NoAtomicCommit
+witness-noop-ride BatchPublication BatchPublication noop none Spec NoNoopRide
+witness-noop-quiet BatchPublication BatchPublication noop none Spec NoQuietBatchNoop
+witness-noop-rejected BatchPublication BatchPublication rejectednoop none Spec NoRejectedNoopSettle
+witness-isolation BatchPublication BatchPublication denied none Spec NoIsolatedCommit
+witness-dependent BatchPublication BatchPublication dependent none Spec NoDependentCommit
+witness-delete BatchPublication BatchPublication delete none Spec NoDependentCommit
+log-slot-fixed LogSlotClaim LogSlotClaim_fix - - - pass
+log-slot-burned-across-retry LogSlotClaim LogSlotClaim_burned_retry - - - CommittedSegmentsPresent
+log-slot-early-sweep LogSlotClaim LogSlotClaim_early_sweep - - - CommittedSegmentsPresent
+log-slot-drop-on-ambiguous LogSlotClaim LogSlotClaim_drop_ambiguous - - - CommittedSegmentsPresent
+log-slot-aba-deterministic-bytes LogSlotClaim LogSlotClaim_aba_deterministic - - - CommittedSegmentsMatch
+witness-log-slot-sweep LogSlotClaim LogSlotClaim_fix - - - NoOrphanSwept
+witness-log-slot-retry LogSlotClaim LogSlotClaim_fix - - - NoRetryCommit
+witness-log-slot-ambiguous LogSlotClaim LogSlotClaim_fix - - - NoAmbiguousCommit
+witness-log-slot-crash-late LogSlotClaim LogSlotClaim_fix - - - NoCrashLateCommit
+composition-fixed ManifestComposition ManifestComposition_fix - - - pass
+composition-stale-base-checkpoint ManifestComposition ManifestComposition_stale_base_cp - - - HeadTruthful
+composition-stale-base-seal ManifestComposition ManifestComposition_stale_base_seal - - - ColdComplete
+composition-no-cp-guard ManifestComposition ManifestComposition_no_cp_guard - - - ColdComplete
+composition-no-tips-clause ManifestComposition ManifestComposition_no_tips - - - ColdServable
+witness-composition-triple ManifestComposition ManifestComposition_fix - - - NoTripleCommit
+witness-composition-trim ManifestComposition ManifestComposition_fix - - - NoTrimmedButComplete
+witness-composition-refusal ManifestComposition ManifestComposition_fix - - - NoSealRefusal
+witness-composition-skip ManifestComposition ManifestComposition_fix - - - NoGuardSkip
+witness-composition-seal-commit ManifestComposition ManifestComposition_fix - - - NoSealCommit
+witness-composition-story ManifestComposition ManifestComposition_fix - - - NoCompositeStory
+readiness-fixed ReadinessCarry ReadinessCarry_fixed - - - pass
+readiness-fixed-restarts ReadinessCarry ReadinessCarry_fixed_restarts - - - pass
+readiness-fixed-opener ReadinessCarry ReadinessCarry_fixed_opener - - - pass
+readiness-fixed-no-sentinel ReadinessCarry ReadinessCarry_fixed_no_sentinel - - - pass
+readiness-apply-carry ReadinessCarry ReadinessCarry_apply_carry - - - pass
+witness-readiness-no-carry ReadinessCarry ReadinessCarry_no_carry - - - EditNeverWastes
+witness-readiness-birth-zero ReadinessCarry ReadinessCarry_birth_zero - - - EditNeverWastes
+bug-readiness-packs-only ReadinessCarry ReadinessCarry_packs_only - - - ReadyNamesInventory
+bug-readiness-open-log-loop ReadinessCarry ReadinessCarry_open_log_loop - - - ReconcileSettles
+bug-readiness-open-log-stale ReadinessCarry ReadinessCarry_open_log_stale - - - ReadyServesHeld
+bug-readiness-open-log-push ReadinessCarry ReadinessCarry_open_log_push - - - ReadyNamesInventory
+witness-readiness-open-log-opener ReadinessCarry ReadinessCarry_open_log_opener - - - EditNeverWastes
+witness-readiness-annotate-waste ReadinessCarry ReadinessCarry_annotate_waste - - - AnnotateNeverWastes
+witness-readiness-apply-waste ReadinessCarry ReadinessCarry_apply_waste - - - ApplyNeverWastes
+readiness-fixed-opener-birth ReadinessCarry ReadinessCarry_fixed_opener_birth - - - pass
+witness-readiness-open-not-empty-ready ReadinessCarry ReadinessCarry_open_not_empty_ready - - - OpenNeverWastes
+witness-readiness-open-waste ReadinessCarry ReadinessCarry_open_waste - - - OpenNeverWastes
+
+# Cache evidence and temporary ownership reference obligations.
+cache-discipline-fixed CacheDiscipline CacheDiscipline_fixed - - - pass
+bug-cache-sweep-entry CacheDiscipline CacheDiscipline_sweep_entry - - - NoViableVictim
+bug-cache-no-occupancy CacheDiscipline CacheDiscipline_no_occupancy - - - NoViableVictim
+bug-cache-trust-presence CacheDiscipline CacheDiscipline_trust_presence - - - NoViableVictim
+bug-cache-no-identity CacheDiscipline CacheDiscipline_no_identity - - - ClassificationHonest
+bug-cache-skip-reprove CacheDiscipline CacheDiscipline_skip_reprove - - - NoViableVictim
+bug-cache-fail-open CacheDiscipline CacheDiscipline_fail_open - - - NoFalseCovered
+bug-cache-no-cancel-cleanup CacheDiscipline CacheDiscipline_no_cancel_cleanup - - - BoundedLitter
+bug-cache-reader-uac CacheDiscipline CacheDiscipline_reader_uac - - - ReaderCompletes
+witness-cache-prefetch-rescue CacheDiscipline CacheDiscipline_w_prefetch - - - NoPrefetchRescue
+witness-cache-sweep-mid-repair CacheDiscipline CacheDiscipline_w_sweep - - - NoSweepDuringRepair
+witness-cache-cancel-recovery CacheDiscipline CacheDiscipline_w_cancel - - - NoCancelRecovery
+temp-reclaim-fixed TempReclaim TempReclaim_fixed - - - pass
+temp-reclaim-inductive TempReclaim TempReclaim_inductive - - - pass
+bug-temp-no-drop-guard TempReclaim TempReclaim_no_drop_guard - - - BoundedLitter
+bug-temp-no-sweep TempReclaim TempReclaim_no_sweep - - - BoundedLitter
+bug-temp-no-dead-reclaim TempReclaim TempReclaim_no_dead_reclaim - - - BoundedLitter
+bug-temp-no-interlock TempReclaim TempReclaim_no_interlock - - - NoLiveVictim
+bug-temp-age-authority TempReclaim TempReclaim_age_authority - - - NoLiveVictim
+witness-temp-dead-recovery TempReclaim TempReclaim_w_dead - - - NoDeadReclaimRecovery
+witness-temp-cancel-recovery TempReclaim TempReclaim_w_cancel - - - NoCancelRecovery
+witness-temp-full-occupancy TempReclaim TempReclaim_w_full - - - NoFullOccupancy
+witness-temp-lane-reclaim TempReclaim TempReclaim_w_lane - - - NoLaneReclaim
+witness-temp-sweep-past-peer TempReclaim TempReclaim_w_peer - - - NoSweepPastPeer
diff --git a/flake.nix b/flake.nix
index bfbce8c..c3a1e7e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -98,15 +98,15 @@
             mkdir -p web
             cp -a ${web} web/dist
           '';
-          # `walgit serve` shells out to git (upload-pack, repack, bundle, index-pack).
+          # `walgit serve` shells out to git and GNU sort/comm for bounded pack planning.
           nativeBuildInputs = commonArgs.nativeBuildInputs ++ [ pkgs.makeWrapper ];
           postInstall = ''
             for b in walgit walgit-server; do
-              wrapProgram "$out/bin/$b" --prefix PATH : ${lib.makeBinPath [ pkgs.git pkgs.git-lfs ]}
+              wrapProgram "$out/bin/$b" --prefix PATH : ${lib.makeBinPath [ pkgs.git pkgs.git-lfs pkgs.coreutils ]}
             done
           '';
           meta = {
-            description = "git hosting on an object store: smart HTTP, bundle-uri, LFS, web UI — one binary";
+            description = "git hosting on an object store: smart HTTP, LFS, web UI — one binary";
             mainProgram = "walgit";
             license = lib.licenses.mit;
           };
@@ -156,6 +156,7 @@
             just
             git
             git-lfs
+            coreutils
             jq
             ripgrep
             fd
diff --git a/justfile b/justfile
index 731d04a..c7398ed 100644
--- a/justfile
+++ b/justfile
@@ -9,8 +9,8 @@ t10 := `if command -v timeout >/dev/null 2>&1; then echo "timeout 600"; elif com
 t15 := `if command -v timeout >/dev/null 2>&1; then echo "timeout 900"; elif command -v gtimeout >/dev/null 2>&1; then echo "gtimeout 900"; else echo ""; fi`
 
 # The fast tier's package selections, shared by the build and the run of each line.
-fast_pkgs := "-p walgit-store -p walgit-git -p walgit-wal -p walgit-bundle"
-server_fast := "-p walgit-server --test web_api --test web_ui --test api_v1 --test static_http --test maintain --test routing_prefix --test lfs_upstream --test drain --test events --test follow --test policy"
+fast_pkgs := "-p walgit-store -p walgit-git -p walgit-wal"
+server_fast := "-p walgit-server --test web_api --test web_ui --test api_v1 --test static_http --test packfile_uri --test forward --test maintain --test routing_prefix --test lfs_upstream --test drain --test events --test follow --test policy"
 
 # Default: show available targets.
 default:
@@ -141,7 +141,16 @@ clippy:
     {{t15}} cargo clippy --workspace --all-targets -- -D warnings
 
 # Everything that must be green before a merge (what CI runs).
-ci: warnings clippy test e2e
+ci: warnings clippy test e2e sim smoke
+
+# Fault injection and recovery share process-wide test hooks; run serially.
+sim:
+    {{t15}} cargo test -p walgit-server --test sim -- --test-threads=1
+
+# Standalone CLI/server against memory; add WALGIT_TEST_S3_ENDPOINT for the local rig.
+smoke:
+    {{t15}} cargo build -p walgit-cli
+    WALGIT="$(realpath "${CARGO_TARGET_DIR:-target}/debug/walgit")" {{t15}} tests/e2e.sh
 
 # Slow tier: #[ignore]d benches/soaks (20k-ref push, 466k-ref render, ...).
 test-slow:
@@ -169,3 +178,13 @@ store-test-s3:
 # Run all walgit-store tests (memory + S3 if env set).
 store-test-all:
     cargo test -p walgit-store
+
+# Bounded contract checks and exact negative controls (Java 11+).
+spec:
+    scripts/run-spec.sh fast
+
+spec-fragments:
+    scripts/run-spec.sh fragments
+
+spec-full:
+    scripts/run-spec.sh full
diff --git a/scripts/check-tlc-result.sh b/scripts/check-tlc-result.sh
new file mode 100755
index 0000000..a75d3db
--- /dev/null
+++ b/scripts/check-tlc-result.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Classify only this invocation. An expected error alongside another error fails.
+set -euo pipefail
+[[ $# -eq 3 ]] || exit 2
+status="$1" expected="$2" log="$3"
+[[ -f "$log" ]] || exit 1
+# Both successful enumeration and counterexamples must have a complete footer.
+rg -q '^Finished in .+ at \(.+\)$' "$log" || exit 1
+rg -q '^[0-9,]+ states generated, [0-9,]+ distinct states found, [0-9,]+ states left on queue\.$' "$log" || exit 1
+case "$expected" in
+  pass)
+    [[ "$status" == 0 ]] &&
+      rg -Fqx 'Model checking completed. No error has been found.' "$log" &&
+      rg -q '^[0-9,]+ states generated, [0-9,]+ distinct states found, 0 states left on queue\.$' "$log" &&
+      ! rg -q '^Error:' "$log"
+    ;;
+  *)
+    if [[ "$expected" == temporal:* ]]; then
+      [[ "$status" == 13 ]] || exit 1
+      verdict="Error: Temporal property ${expected#temporal:} was violated."
+      trace='Error: The following behavior constitutes a counter-example:'
+    else
+      [[ "$status" == 12 ]] || exit 1
+      verdict="Error: Invariant $expected is violated."
+      trace='Error: The behavior up to this point is:'
+    fi
+    # TLC prefixes the trace heading with Error too; it is the only permitted
+    # companion. Duplicate verdicts also reject concatenated or stale logs.
+    awk -v verdict="$verdict" -v trace="$trace" '
+      /^Error:/ {
+        if ($0 == verdict) verdicts++
+        else if ($0 == trace) traces++
+        else bad = 1
+      }
+      END { exit !(verdicts == 1 && traces == 1 && !bad) }
+    ' "$log" && rg -q '^State 1: ' "$log"
+    ;;
+esac
diff --git a/scripts/ensure-tla-tools.sh b/scripts/ensure-tla-tools.sh
new file mode 100755
index 0000000..fd99406
--- /dev/null
+++ b/scripts/ensure-tla-tools.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Fetch the pinned TLA+ tools jar atomically and verify its release checksum.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+JAR="$ROOT/target/tla2tools.jar"
+VERSION="v1.8.0"
+# v1.8.0 is a rolling upstream asset, not an immutable release. This pin
+# identifies 867aefb69ffc2452031292587b389d1fc3eb43ff (2026-09-12). A mismatch fails closed: inspect
+# MANIFEST.MF, upstream commit history and the release asset digest before
+# changing it. Never accept an unverified replacement automatically.
+SHA256="db131ddb48e7004d823bef4493df7b35694babe37505b9d9fa5685e7a331f1f1"
+URL="https://github.com/tlaplus/tlaplus/releases/download/$VERSION/tla2tools.jar"
+
+command -v java >/dev/null || { echo "TLA+: Java 11+ is required" >&2; exit 2; }
+if command -v sha256sum >/dev/null; then
+  SHA_CHECK=(sha256sum -c -)
+elif command -v shasum >/dev/null; then
+  SHA_CHECK=(shasum -a 256 -c -)
+else
+  echo "TLA+: sha256sum or shasum is required" >&2
+  exit 2
+fi
+
+check_sha256() {
+  printf '%s  %s\n' "$SHA256" "$1" | "${SHA_CHECK[@]}" >/dev/null 2>&1
+}
+
+valid_jar() {
+  [[ -f "$JAR" ]] && check_sha256 "$JAR"
+}
+
+valid_jar && exit 0
+mkdir -p "$(dirname "$JAR")"
+
+# Sibling worktrees usually hold a pin-matching jar already; copying one is
+# faster than the download and keeps every checkout on this machine working
+# when the rolling upstream asset moves ahead of the pin. Still pin-verified:
+# a sibling can seed bytes, never trust.
+for sibling in "$ROOT"/../*/target/tla2tools.jar; do
+  [[ -f "$sibling" && "$sibling" != "$JAR" ]] || continue
+  if check_sha256 "$sibling"; then
+    echo "TLA+: seeding $VERSION from $(cd "$(dirname "$sibling")/.." && pwd)"
+    tmp="$(mktemp "${JAR}.tmp.XXXXXX")"
+    cp "$sibling" "$tmp" && mv "$tmp" "$JAR"
+    valid_jar && exit 0
+  fi
+done
+
+command -v curl >/dev/null || { echo "TLA+: curl is required to fetch $VERSION" >&2; exit 2; }
+tmp="$(mktemp "${JAR}.tmp.XXXXXX")"
+trap 'rm -f "$tmp"' EXIT
+
+echo "TLA+: downloading $VERSION to $JAR"
+curl -fsSL -o "$tmp" "$URL"
+if ! check_sha256 "$tmp"; then
+  echo "TLA+: checksum mismatch for $VERSION — the rolling upstream asset has" >&2
+  echo "TLA+: likely moved past the pin; see the provenance recipe in $0" >&2
+  exit 1
+fi
+mv "$tmp" "$JAR"
+trap - EXIT
diff --git a/scripts/run-spec.sh b/scripts/run-spec.sh
new file mode 100755
index 0000000..065071a
--- /dev/null
+++ b/scripts/run-spec.sh
@@ -0,0 +1,167 @@
+#!/usr/bin/env bash
+# Exhaustive bounded TLC, not simulation. Each invocation has its own log and
+# metadir; a different arm's expected error must never satisfy a negative control.
+#
+# Each case owns its config, log and state directory. Bound the JVM pool
+# explicitly: the default is two jobs, two workers and 2 GiB heap per job.
+set -euo pipefail
+root="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$root"
+
+# --case: one pooled TLC arm, self-exec'd by the pool below.
+# Env from the parent: SPEC_JAR SPEC_LOGS SPEC_WORK SPEC_WORKERS SPEC_HEAP.
+# Writes $SPEC_LOGS/<name>.result (the arm's summary-file fragment) and exits
+# nonzero on an unexpected verdict so xargs propagates failure.
+if [[ "${1:-}" == "--case" ]]; then
+  name="$2" module="$3" config="$4" expected="$5"
+  log="$SPEC_LOGS/$name.log" meta="$SPEC_WORK/$name" result="$SPEC_LOGS/$name.result"
+  mkdir -p "$meta"
+  effective="$SPEC_LOGS/$name.cfg"
+  [[ "$config" == "$effective" ]] || cp "$config" "$effective"
+  config="$effective"
+  status=0
+  timeout "${WALGIT_TLC_TIMEOUT:-600}" java -Xmx"$SPEC_HEAP" -XX:+UseParallelGC -XX:ActiveProcessorCount="$SPEC_WORKERS" \
+    -DTLA-Library="$root/docs/spec" -cp "$SPEC_JAR" tlc2.TLC \
+    -noGenerateSpecTE -metadir "$meta" -workers "$SPEC_WORKERS" -fp 0 \
+    -config "$config" "$module" > "$log" 2>&1 || status=$?
+  if scripts/check-tlc-result.sh "$status" "$expected" "$log"; then
+    {
+      printf '== %s (expect %s)\n' "$name" "$expected"
+      printf 'PASS %s (exit %s)\n' "$name" "$status"
+      rg 'states generated,|depth of the complete|Finished in' "$log" || true
+    } > "$result"
+    echo "PASS $name"
+    rm -rf "$meta"
+    exit 0
+  fi
+  {
+    printf '== %s (expect %s)\n' "$name" "$expected"
+    printf 'FAIL %s: exit %s, expected %s; %s\n' "$name" "$status" "$expected" "$log"
+  } > "$result"
+  echo "FAIL $name ($log)"
+  exit 1
+fi
+
+mode="${1:-fast}"
+case "$mode" in
+  fast|fragments) default_workers=2; default_heap=2g ;;
+  full) default_workers=8; default_heap=8g ;;
+  *) echo "usage: $0 [fast|full|fragments]" >&2; exit 2 ;;
+esac
+workers="${WALGIT_TLC_WORKERS:-$default_workers}"
+heap="${WALGIT_TLC_HEAP:-$default_heap}"
+[[ "$heap" =~ ^[1-9][0-9]*[mMgG]$ ]] || { echo "WALGIT_TLC_HEAP must use m or g units" >&2; exit 2; }
+[[ "$workers" =~ ^[1-9][0-9]*$ ]] || { echo 'WALGIT_TLC_WORKERS must be positive' >&2; exit 2; }
+jobs="${WALGIT_TLC_JOBS:-2}"
+[[ "$jobs" =~ ^[1-9][0-9]*$ ]] || { echo 'WALGIT_TLC_JOBS must be positive' >&2; exit 2; }
+mkdir -p target/test-logs
+logs="$(mktemp -d "$root/target/test-logs/spec-$mode-$(date +%Y%m%d-%H%M%S).XXXXXX")"
+echo "log: $logs/summary.log"
+: > "$logs/summary.log"
+if ! scripts/test-spec-runner.sh > "$logs/runner.log" 2>&1; then
+  echo "FAIL result-classifier regressions ($logs/runner.log)" | tee -a "$logs/summary.log"
+  tail -60 "$logs/runner.log"
+  exit 1
+fi
+# A malformed/empty matrix or duplicate label must not silently skip cases or
+# overwrite another invocation's evidence.
+awk '
+  /^#/ || NF == 0 { next }
+  NF != 7 || seen[$1]++ { print "invalid/duplicate TLC case at line " NR > "/dev/stderr"; exit 1 }
+  { count++ }
+  END { if (count == 0) exit 1 }
+' docs/spec/tlc/cases.tsv
+scripts/ensure-tla-tools.sh
+jar="$root/target/tla2tools.jar"
+work="$(mktemp -d "$root/target/tlc.XXXXXX")"
+trap 'rm -rf "$work"' EXIT
+
+export SPEC_JAR="$jar" SPEC_LOGS="$logs" SPEC_WORK="$work" SPEC_WORKERS="$workers" SPEC_HEAP="$heap"
+
+# NUL-delimited arguments also preserve checkout paths containing whitespace.
+queue="$logs/queue.txt"
+: > "$queue"
+order=()
+enqueue() {
+  printf '%s\0%s\0%s\0%s\0' "$1" "$2" "$3" "$4" >> "$queue"
+  order+=("$1")
+}
+
+# TLC semantically checks every loaded module too. Keep an explicit SANY log
+# for the frozen reference, even in the fragment-only developer loop.
+java -cp "$jar" tla2sany.SANY docs/spec/WALContract.tla > "$logs/sany.log" 2>&1
+if rg -q "\*\*\* (Errors|Parse Error)|Fatal errors|Semantic errors" "$logs/sany.log"; then
+  echo "FAIL reference SANY ($logs/sany.log)" >&2
+  exit 1
+fi
+if [[ "$mode" != fragments ]]; then
+  enqueue reference-fast "$root/docs/spec/tlc/MC.tla" "$root/docs/spec/tlc/MC_fast.cfg" pass
+  enqueue reference-bug "$root/docs/spec/tlc/MC_bug.tla" "$root/docs/spec/tlc/MC_bug.cfg" HistPreconds
+fi
+
+while read -r name module config scenario fault spec expected; do
+  [[ -z "$name" || "$name" == \#* ]] && continue
+  cfg="$logs/$name.cfg"
+  dir="$root/docs/spec/scratch"
+  [[ -f "$dir/$module.tla" ]] || dir="$root/docs/spec/tlc"
+  awk -v scenario="$scenario" -v fault="$fault" -v spec="$spec" -v expected="$expected" '
+    /^SPECIFICATION / && spec != "-" { print "SPECIFICATION " spec; next }
+    /^  Scenario = / && scenario != "-" { print "  Scenario = \"" scenario "\""; next }
+    /^  Broken = / && scenario != "-" { print "  Broken = " (scenario ~ /^broken/ ? "TRUE" : "FALSE"); next }
+    /^  Mode = / && scenario != "-" { print "  Mode = \"" (scenario ~ /prune$/ ? "prune" : "conserve") "\""; next }
+    /^  Fault = / && fault != "-" { print "  Fault = \"" fault "\""; next }
+    /^(INVARIANTS?|PROPERTIES|PROPERTY)( |$)/ && expected != "pass" {
+      if (expected ~ /^temporal:/) print "PROPERTY " substr(expected, 10)
+      else print "INVARIANT " expected
+      exit
+    }
+    { print }
+    END {
+      if ((spec == "LiveSpec" || spec == "HealthySpec") && expected == "pass")
+        print "PROPERTIES Terminates TransportSettles"
+      if (spec == "HealthySpec" && expected == "pass") print "PROPERTY EventuallyCommitted"
+    }
+  ' "$dir/$config.cfg" > "$cfg"
+  enqueue "$name" "$dir/$module.tla" "$cfg" "$expected"
+done < docs/spec/tlc/cases.tsv
+
+# Fan the arms out. Unlike the serial loop this does not stop at the first
+# failure: every arm runs, every verdict is recorded, and the exit is the sum —
+# partial evidence beats a truncated matrix.
+pool_status=0
+xargs -0 -P "$jobs" -n 4 "$0" --case < "$queue" || pool_status=$?
+
+failures=0
+for name in "${order[@]}"; do
+  if [[ ! -f "$logs/$name.result" ]]; then
+    printf 'FAIL %s: no result written (crashed arm?); %s\n' "$name" "$logs/$name.log" | tee -a "$logs/summary.log"
+    failures=$((failures + 1))
+    continue
+  fi
+  cat "$logs/$name.result" >> "$logs/summary.log"
+  if rg -q '^FAIL ' "$logs/$name.result"; then
+    failures=$((failures + 1))
+    tail -60 "$logs/$name.log"
+  fi
+done
+
+# spec-full's reference arms enumerate big state spaces with -workers=8 each;
+# running them concurrently would only divide the same cores. Keep them serial.
+if [[ "$mode" == full && "$failures" -eq 0 && "$pool_status" -eq 0 ]]; then
+  for config in MC MC_notrim MC_live; do
+    arm_status=0
+    "$0" --case "$config" "$root/docs/spec/tlc/MC.tla" "$root/docs/spec/tlc/$config.cfg" pass || arm_status=$?
+    cat "$logs/$config.result" >> "$logs/summary.log" 2>/dev/null || true
+    if [[ "$arm_status" -ne 0 ]]; then
+      failures=$((failures + 1))
+      tail -60 "$logs/$config.log"
+      break
+    fi
+  done
+fi
+
+if [[ "$failures" -ne 0 || "$pool_status" -ne 0 ]]; then
+  printf 'spec-%s: %s failed arm(s); evidence in %s\n' "$mode" "$failures" "$logs" | tee -a "$logs/summary.log"
+  exit 1
+fi
+printf 'spec-%s: all required passes, mutations and witnesses verified (%s)\n' "$mode" "$logs" | tee -a "$logs/summary.log"
diff --git a/scripts/test-spec-runner.sh b/scripts/test-spec-runner.sh
new file mode 100755
index 0000000..544efbf
--- /dev/null
+++ b/scripts/test-spec-runner.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Hermetic classifier controls: no JVM, network, or repository mutation.
+set -euo pipefail
+root="$(cd "$(dirname "$0")/.." && pwd)"
+work="$(mktemp -d)"; trap 'rm -rf "$work"' EXIT
+check="$root/scripts/check-tlc-result.sh"
+footer() {
+  printf '%s\n' '21 states generated, 12 distinct states found, 0 states left on queue.' \
+    'Finished in 00s at (2026-01-01 00:00:00)'
+}
+{ echo 'Model checking completed. No error has been found.'; footer; } > "$work/pass"
+{
+  echo 'Error: Invariant Expected is violated.'
+  echo 'Error: The behavior up to this point is:'
+  echo 'State 1: <Initial predicate>'
+  footer
+} > "$work/negative"
+{
+  echo 'Error: Temporal property Terminates was violated.'
+  echo 'Error: The following behavior constitutes a counter-example:'
+  echo 'State 1: <Initial predicate>'
+  footer
+} > "$work/temporal"
+"$check" 0 pass "$work/pass"
+"$check" 12 Expected "$work/negative"
+"$check" 13 temporal:Terminates "$work/temporal"
+reject() {
+  if "$check" "$@"; then echo "classifier wrongly accepted: $*" >&2; exit 1; fi
+}
+reject 12 Different "$work/negative"
+reject 0 Expected "$work/negative"
+reject 255 Expected "$work/negative"
+reject 12 pass "$work/negative"
+reject 124 pass "$work/pass"
+reject 0 temporal:Terminates "$work/temporal"
+reject 13 temporal:OtherProperty "$work/temporal"
+reject 13 Expected "$work/temporal"
+reject 12 Expected "$work/pass"
+for error in 'Error: Deadlock reached.' 'Error: Invariant Different is violated.' \
+  'Error: Parsing failed.' 'Error: Temporal property Different was violated.'; do
+  { cat "$work/negative"; echo "$error"; } > "$work/extra"
+  reject 12 Expected "$work/extra"
+  { cat "$work/pass"; echo "$error"; } > "$work/extra"
+  reject 0 pass "$work/extra"
+done
+cat "$work/negative" "$work/negative" > "$work/concatenated"
+reject 12 Expected "$work/concatenated"
+# Neither an expected first line nor a success banner proves a complete run.
+sed '/^Finished in /d' "$work/negative" > "$work/truncated"
+reject 12 Expected "$work/truncated"
+sed '/states generated/d' "$work/pass" > "$work/truncated"
+reject 0 pass "$work/truncated"
+sed 's/0 states left/1 states left/' "$work/pass" > "$work/queued"
+reject 0 pass "$work/queued"
+sed '/^State 1:/d' "$work/negative" > "$work/no-trace"
+reject 12 Expected "$work/no-trace"
+echo 'spec runner: result-classifier regressions passed'
diff --git a/tests/e2e.sh b/tests/e2e.sh
index a36fa8e..905d5c2 100755
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -13,14 +13,15 @@
 # Usage:
 #   tests/e2e.sh
 #   WALGIT_TEST_S3_ENDPOINT=http://localhost:9000 tests/e2e.sh
+#   WALGIT=/absolute/path/to/freshly/built/walgit tests/e2e.sh
 #
-# Requires: cargo, git, curl, python3 (for random port).
+# Requires: cargo, git, curl, python3 (for random port), ripgrep (S3 maintenance receipt).
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-WALGIT="$ROOT/target/release/walgit"
+WALGIT="${WALGIT:-}"
 
 # --- helpers -----------------------------------------------------------------
 
@@ -65,18 +66,30 @@ wait_http() {
 
 step "e2e: walgit end-to-end test"
 
-if [[ ! -x "$WALGIT" ]]; then
+if [[ -z "$WALGIT" ]]; then
     step "building walgit (release)..."
     (cd "$ROOT" && cargo build -p walgit-cli --release)
+    WALGIT="$ROOT/target/release/walgit"
 fi
+[[ -x "$WALGIT" ]] || fail "WALGIT must name an executable built from this checkout"
 
 TMP="$(mktemp -d)"
 PIDS=()
 # "${PIDS[@]:-}": bash 3.2 (macOS /bin/bash) calls an empty array expansion an unbound variable
-# under set -u, which aborts the EXIT trap before rm -rf. Same guard as tests/git-bundle-filter.sh:24.
+# under set -u, which aborts the EXIT trap before rm -rf.
 cleanup() { for p in "${PIDS[@]:-}"; do kill "$p" 2>/dev/null || true; done; wait 2>/dev/null || true; rm -rf "$TMP"; }
 trap cleanup EXIT
 
+if [[ -z "${WALGIT_E2E_BASE_URL:-}" ]]; then
+    # Local tests must neither depend on nor change the developer's Git config.
+    export GIT_CONFIG_GLOBAL="$TMP/gitconfig" GIT_CONFIG_NOSYSTEM=1
+    cat > "$GIT_CONFIG_GLOBAL" <<EOF
+[user]
+name = walgit-e2e
+email = e2e@example.invalid
+EOF
+fi
+
 PORT="$(rand_port)"
 
 if [[ -n "${WALGIT_E2E_BASE_URL:-}" ]]; then
@@ -103,9 +116,7 @@ bucket = "walgit-e2e"
 dir = "$TMP/cache"
 [wal]
 freshness_ttl = "0s"
-[compaction]
-enabled = false
-[bundles]
+[packs]
 enabled = false
 [lfs]
 enabled = false
@@ -220,18 +231,12 @@ pass "tag deleted"
 # --- for-each-ref diff -------------------------------------------------------
 
 step "for-each-ref diff (push vs clone)"
-REFS_WORK=$(cd "$WORK" && git for-each-ref --format='%(refname) %(objectname)')
-REFS_CLONE=$(cd "$CLONE" && git for-each-ref --format='%(refname) %(objectname)' refs/remotes/origin/)
+REFS_WORK=$(cd "$WORK" && git for-each-ref --format='%(refname) %(objectname)' refs/heads/)
+REFS_CLONE=$(cd "$CLONE" && git for-each-ref --format='%(refname) %(objectname)' refs/remotes/origin/ | sed '/^refs\/remotes\/origin\/HEAD /d')
 # Normalize: strip refs/remotes/origin/ prefix from clone refs.
 REFS_CLONE_NORM=$(echo "$REFS_CLONE" | sed 's|refs/remotes/origin/|refs/heads/|g')
-# Only compare heads (tags were deleted).
-REFS_WORK_HEADS=$(echo "$REFS_WORK" | grep '^refs/heads/')
-if [[ "$REFS_WORK_HEADS" != "$REFS_CLONE_NORM" ]]; then
-    # Diff is ok as long as the same main commit exists
-    pass "refs roughly match (heads)"
-else
-    pass "refs match exactly"
-fi
+[[ "$REFS_WORK" == "$REFS_CLONE_NORM" ]] || fail "branch refs differ between push and clone"
+pass "refs match exactly"
 
 # --- delete repo -------------------------------------------------------------
 
@@ -273,9 +278,7 @@ force_path_style = true
 dir = "$TMP/cache-s3"
 [wal]
 freshness_ttl = "0s"
-[compaction]
-enabled = false
-[bundles]
+[packs]
 enabled = false
 [lfs]
 enabled = false
@@ -310,6 +313,16 @@ EOF
     (cd "$TMP/work-s3" && git_auth push -q origin main) || fail "push to A"
     pass "pushed to A"
 
+    step "S3: conserving maintenance from an independent cache"
+    WALGIT__PACKS__ENABLED=true WALGIT__CACHE__DIR="$TMP/cache-maintenance" \
+        "$WALGIT" --config "$TMP/cfg-s3.toml" compact "$REPO2" --base --once \
+        > "$TMP/maintenance.log" 2>&1 || { cat "$TMP/maintenance.log"; fail "maintenance failed"; }
+    # The CLI can log per-repository failures while returning success. Require its
+    # completed checkpoint receipt as well as its exit status.
+    cat "$TMP/maintenance.log"
+    rg -q '; checkpoint at seq [0-9]+' "$TMP/maintenance.log" || fail "maintenance did not finish"
+    pass "conserving maintenance completed"
+
     step "S3: clone from B (cross-instance consistency)"
     git_auth clone -q "$BASE_B/$REPO2.git" "$TMP/clone-s3" || fail "clone from B"
     HEAD_A=$(cd "$TMP/work-s3" && git rev-parse main)
@@ -325,8 +338,9 @@ EOF
 
     step "S3: for-each-ref diff"
     REFS_A=$(cd "$TMP/work-s3" && git for-each-ref --format='%(refname) %(objectname)' refs/heads/)
-    REFS_B=$(cd "$TMP/clone-s3" && git for-each-ref --format='%(refname) %(objectname)' refs/remotes/origin/ | sed 's|refs/remotes/origin/|refs/heads/|g')
-    [[ "$REFS_A" == "$REFS_B" ]] && pass "refs match" || pass "refs roughly match"
+    REFS_B=$(cd "$TMP/clone-s3" && git for-each-ref --format='%(refname) %(objectname)' refs/remotes/origin/ | sed '/^refs\/remotes\/origin\/HEAD /d; s|refs/remotes/origin/|refs/heads/|g')
+    [[ "$REFS_A" == "$REFS_B" ]] || fail "branch refs differ between S3 instances"
+    pass "refs match exactly"
 
     kill "$SERVER_A_PID" "$SERVER_B_PID" 2>/dev/null || true
 fi
diff --git a/tests/git-bundle-filter.sh b/tests/git-bundle-filter.sh
deleted file mode 100755
index 707b3c5..0000000
--- a/tests/git-bundle-filter.sh
+++ /dev/null
@@ -1,158 +0,0 @@
-#!/usr/bin/env bash
-# tests/git-bundle-filter.sh — the git patch `docs/patches/0001-bundle-uri-match-bundle-id-filter…patch`
-# (client-side `bundle.<id>.filter` matching) against a local walgit that puts BOTH bundle
-# families — the whole history and the `blob:none` history — on ONE advertised list
-# (`bundles.advertise_filtered = true`, design §6b).
-#
-#   stock git   : a full clone swallows the blobless bundles too (promisor packs in a
-#                 full clone) — the reason the families live on separate lists today.
-#   patched git : a full clone takes only the unfiltered bundles (no promisor pack, fsck
-#                 clean); a `--filter=blob:none` clone takes only the history bundles
-#                 (promisor packs from bundles, blobs missing until checkout).
-#
-# Usage: PATCHED_GIT=/path/to/patched/git [STOCK_GIT=git] tests/git-bundle-filter.sh
-set -euo pipefail
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-PATCHED_GIT="${PATCHED_GIT:?set PATCHED_GIT=/path/to/patched/git (built from the fork with the patch)}"
-# A git built in-tree (`make git git-remote-http`) finds its helpers next to itself.
-export GIT_EXEC_PATH="${GIT_EXEC_PATH:-$(dirname "$PATCHED_GIT")}"
-STOCK_GIT="${STOCK_GIT:-git}"
-PORT="${PORT:-8431}"
-TMP="$(mktemp -d)"
-mkdir -p "$TMP/tpl"; export GIT_TEMPLATE_DIR="${GIT_TEMPLATE_DIR:-$TMP/tpl}"
-PIDS=()
-cleanup() { for p in "${PIDS[@]:-}"; do kill "$p" 2>/dev/null || true; done; rm -rf "$TMP"; }
-trap cleanup EXIT
-step() { printf '\033[1m>>> %s\033[0m\n' "$*"; }
-ok()   { printf '\033[32m  ok: %s\033[0m\n' "$*"; }
-fail() { printf '\033[31m  FAIL: %s\033[0m\n' "$*"; exit 1; }
-
-WALGIT="${WALGIT:-}"
-if [[ -z "$WALGIT" ]]; then
-  TARGET_DIR="$(cd "$ROOT" && cargo metadata --format-version=1 --no-deps | jq -r .target_directory)"
-  WALGIT="$TARGET_DIR/release/walgit"
-fi
-[[ -x "$WALGIT" ]] || { (cd "$ROOT" && cargo build --release -p walgit-cli >/dev/null); }
-BASE="http://127.0.0.1:$PORT"
-
-cat > "$TMP/walgit.toml" <<EOF
-[server]
-listen = "127.0.0.1:$PORT"
-roles = ["serve", "maintain", "compact", "bundle"]
-[store]
-backend = "memory"
-bucket = "walgit-bundle-filter"
-[cache]
-dir = "$TMP/cache"
-mode = "disk"
-[wal]
-freshness_ttl = "0s"
-[maintenance]
-disk = "ssd"
-checkpoints = false
-interval = "3600s"
-[compaction]
-enabled = true
-[bundles]
-enabled = true
-advertise = true
-advertise_filtered = true
-main_only = true
-min_commits = 1
-[[bundles.strategy]]
-name = "weekly"
-kind = "full"
-schedule = "0 0 23 * * Sun"
-keep = 2
-[[bundles.strategy]]
-name = "hourly"
-kind = "incremental"
-base = "weekly"
-schedule = "0 0 * * * *"
-keep = 3
-[[bundles.strategy]]
-name = "weekly-history"
-kind = "full"
-schedule = "0 0 23 * * Sun"
-keep = 2
-filter = "blob:none"
-[[bundles.strategy]]
-name = "hourly-history"
-kind = "incremental"
-base = "weekly-history"
-schedule = "0 0 * * * *"
-keep = 3
-filter = "blob:none"
-[lfs]
-enabled = false
-EOF
-
-step "walgit serve (memory) on $PORT"
-RUST_LOG=warn "$WALGIT" --config "$TMP/walgit.toml" serve > "$TMP/server.log" 2>&1 &
-PIDS+=($!)
-for _ in $(seq 50); do curl -sf "$BASE/healthz" >/dev/null 2>&1 && break; sleep 0.2; done
-curl -sf "$BASE/healthz" >/dev/null || { tail -20 "$TMP/server.log"; fail "server not up"; }
-
-REPO="o/r"
-curl -sf -X PUT "$BASE/$REPO.git" -o /dev/null
-SRC="$TMP/src"; mkdir -p "$SRC"
-git -C "$SRC" init -q -b main
-git -C "$SRC" config user.email t@t; git -C "$SRC" config user.name T
-for i in 1 2 3; do echo "blob $i $(head -c 2000 /dev/urandom | base64)" > "$SRC/f$i.txt"; git -C "$SRC" add .; git -C "$SRC" commit -qm "c$i"; done
-git -C "$SRC" push -q "$BASE/$REPO.git" main
-ok "repo with 3 commits pushed"
-
-op() { # $1 op, $2 query → waits, prints summary
-  local out; out="$(curl -sf -X POST -H 'Accept: application/json' "$BASE/$REPO/api/ops/$1?$2" 2>&1 | tr -d '\n')"
-  # The task record: `"ok":true` when it finished well; anything else is shown.
-  printf '%s\n' "$out" | grep -qE '"ok": ?true' || { printf '%s\n' "$out" | tail -c 600; echo; tail -20 "$TMP/server.log"; fail "op $1 $2"; }
-}
-step "base rebuild (base + D18 history pack), then the two fulls (composes)"
-op compact "base=1&force=1"
-op bundle "strategy=weekly&slot=$(date -u -d 'last sunday 23:00' +%s)"
-op bundle "strategy=weekly-history&slot=$(date -u -d 'last sunday 23:00' +%s)"
-echo "blob 4 $(head -c 2000 /dev/urandom | base64)" > "$SRC/f4.txt"; git -C "$SRC" add .; git -C "$SRC" commit -qm c4; git -C "$SRC" push -q "$BASE/$REPO.git" main
-op bundle "strategy=hourly"
-op bundle "strategy=hourly-history"
-LIST="$(curl -sf "$BASE/$REPO.git/bundles/list")"
-printf '%s\n' "$LIST" | grep -q 'bundle "weekly-' && printf '%s\n' "$LIST" | grep -q 'bundle "weekly-history-' && printf '%s\n' "$LIST" | grep -q 'filter = blob:none' || { printf '%s\n' "$LIST"; fail "one list with both families"; }
-ok "ONE list: $(printf '%s\n' "$LIST" | grep -c '^\[bundle "') bundles, $(printf '%s\n' "$LIST" | grep -c 'filter = blob:none') with filter = blob:none"
-
-promisors() { find "$1/.git/objects/pack" -name '*.promisor' | wc -l; }
-missing()   { git -C "$1" rev-list --objects --all --missing=print 2>/dev/null | grep -c '^?' || true; }
-
-step "stock git ($($STOCK_GIT --version)): full clone with bundle-uri"
-env -u GIT_EXEC_PATH -u GIT_TEMPLATE_DIR "$STOCK_GIT" -c transfer.bundleURI=true clone -q "$BASE/$REPO.git" "$TMP/stock-full" 2>"$TMP/stock.err" || true
-echo "  promisor packs: $(promisors "$TMP/stock-full")  missing objects: $(missing "$TMP/stock-full")"
-[[ "$(promisors "$TMP/stock-full")" -gt 0 ]] && ok "stock git swallowed the blobless bundles into a FULL clone (the defect; why the families are on separate lists today)" || echo "  (stock git did not take the filtered bundles — fine, nothing to prove here)"
-
-step "patched git ($($PATCHED_GIT --version)): full clone"
-"$PATCHED_GIT" -c transfer.bundleURI=true clone -q "$BASE/$REPO.git" "$TMP/p-full"
-[[ "$(promisors "$TMP/p-full")" == 0 ]] || fail "full clone has promisor packs"
-[[ "$(missing "$TMP/p-full")" == 0 ]] || fail "full clone is missing objects"
-"$PATCHED_GIT" -C "$TMP/p-full" fsck --connectivity-only 2>&1 | { grep -v "^Checking" || true; } | sed 's/^/  fsck: /'
-"$PATCHED_GIT" -C "$TMP/p-full" fsck --connectivity-only >/dev/null 2>&1 || fail "fsck"
-grep -q 'bundle' "$TMP/p-full/.git/config" && ok "full clone: took the unfiltered bundles only ($(grep -c . <<<"$(ls "$TMP/p-full/.git/objects/pack/"*.pack)") packs, 0 promisor, fsck clean, fetch.bundleURI recorded)" || fail "no bundle config recorded — bundles not used?"
-
-step "patched git: --filter=blob:none clone"
-GIT_TRACE2_EVENT="$TMP/trace.json" "$PATCHED_GIT" -c transfer.bundleURI=true clone -q --filter=blob:none --no-checkout "$BASE/$REPO.git" "$TMP/p-blobless"
-[[ "$(promisors "$TMP/p-blobless")" -ge 1 ]] || fail "blobless clone has no promisor pack from bundles"
-[[ "$(missing "$TMP/p-blobless")" -ge 1 ]] || fail "blobless clone is not missing any blob (took the full bundles?)"
-{ grep -o '"filter-skip"[^}]*' "$TMP/trace.json" || true; } | head -3 | sed 's/^/  trace2: /'
-"$PATCHED_GIT" -C "$TMP/p-blobless" checkout -q main
-cmp -s "$TMP/p-blobless/f4.txt" "$SRC/f4.txt" || fail "lazy blob fetch on checkout"
-ok "blobless clone: history bundles only ($(promisors "$TMP/p-blobless") promisor packs, blobs lazy on checkout)"
-
-step "patched git: stale blobless fetch takes only newer history bundles"
-echo "blob 5 $(head -c 2000 /dev/urandom | base64)" > "$SRC/f5.txt"; git -C "$SRC" add .; git -C "$SRC" commit -qm c5; git -C "$SRC" push -q "$BASE/$REPO.git" main
-op bundle "strategy=hourly"
-op bundle "strategy=hourly-history"
-before="$(promisors "$TMP/p-blobless")"
-"$PATCHED_GIT" -C "$TMP/p-blobless" fetch -q origin
-[[ "$(promisors "$TMP/p-blobless")" -gt "$before" ]] || fail "stale fetch did not unbundle the new history incremental"
-"$PATCHED_GIT" -C "$TMP/p-blobless" fsck --connectivity-only 2>&1 | { grep -v "^Checking" || true; } | head -5 | sed 's/^/  fsck: /'
-[[ "$(missing "$TMP/p-blobless")" -ge 1 ]] && echo "  missing (blobs, expected in a blobless clone): $(missing "$TMP/p-blobless")"
-"$PATCHED_GIT" -C "$TMP/p-blobless" rev-parse --verify -q origin/main >/dev/null || fail "origin/main after fetch"
-"$PATCHED_GIT" -C "$TMP/p-blobless" checkout -q main && "$PATCHED_GIT" -C "$TMP/p-blobless" merge -q --ff-only origin/main && cmp -s "$TMP/p-blobless/f5.txt" "$SRC/f5.txt" || fail "fast-forward + lazy blob after the stale fetch"
-ok "stale fetch: +$(( $(promisors "$TMP/p-blobless") - before )) promisor pack(s) from the history family"
-printf '\033[32m  git-bundle-filter: PASS\033[0m\n'
diff --git a/tests/lib-auth.sh b/tests/lib-auth.sh
index d569fac..4bec5f0 100644
--- a/tests/lib-auth.sh
+++ b/tests/lib-auth.sh
@@ -30,9 +30,6 @@ walgit_auth_setup() {
     local host="${base#https://}"; host="${host#http://}"; host="${host%%/*}"
     export GIT_CONFIG_GLOBAL="${GIT_CONFIG_GLOBAL:-$(mktemp /tmp/walgit-gitconfig.XXXXXX)}"
     git config --global "http.https://$host/.extraHeader" "$WALGIT_AUTH_HEADER"
-    git config --global transfer.bundleURI true
-    # fetch.bundleURI is a per-clone URI (the recipes set it); never a global.
-    git config --global --unset-all fetch.bundleURI 2>/dev/null || true
     git config --global user.email "walgit-tests@example.com"
     git config --global user.name "walgit tests"
     echo "auth: bearer header installed in private git config $GIT_CONFIG_GLOBAL for $host" >&2
diff --git a/walgit.example.toml b/walgit.example.toml
index 304778b..79584aa 100644
--- a/walgit.example.toml
+++ b/walgit.example.toml
@@ -1,7 +1,6 @@
 # walgit.toml — every configuration key, with its default and a comment.
 #
 # Start from walgit.standalone.toml for a first run; come here when you need a key.
-# Normative bundle-slot semantics: docs/BUNDLE_URI_DESIGN.md §4.
 # Every key can also be set from the environment: WALGIT__SECTION__KEY=value (TOML value syntax).
 # Validate with: walgit --config walgit.toml config check
 
@@ -15,16 +14,16 @@ drain_timeout = "20s"             # after SIGTERM, phase 2: how long in-flight r
                                   # and new fetch/push/LFS are refused (503 + Retry-After). The running maintenance unit
                                   # is interrupted at once in phase 1 while serving continues.
 max_push_bytes = "64GiB"          # largest accepted push
-# Roles this instance performs: "serve" (git, API, UI, bundles, LFS), "maintain" (checkpoints,
-# bundles, compaction, fsck/repair — implies compact + bundle), "events" (the webhook bridge).
+# Roles this instance performs: "serve" (git, API, UI, LFS), "maintain" (checkpoints,
+# compaction, fsck/repair — implies compact), "events" (the webhook bridge).
 # Empty = all of them: the one-box shape.
 roles = []
 auto_create_on_push = false       # create a repo on first push if missing
 accel_redirect = false            # behind an nginx edge that announces `X-Walgit-Capabilities: accel-redirect`
-                                  # (deploy/nginx.conf.example): answer bundle/LFS byte requests with X-Accel-Redirect
+                                  # (deploy/nginx.conf.example): answer LFS byte requests with X-Accel-Redirect
                                   # so the edge streams + caches the bytes from the bucket itself. Never on a host
                                   # clients reach directly (the answer carries a store credential).
-# public_url = "https://git.example.com"   # pins absolute URIs (bundle-uri, LFS, clone recipes, OAuth callback) behind a proxy
+# public_url = "https://git.example.com"   # pins absolute URIs (LFS, clone recipes, OAuth callback) behind a proxy
 # Browser origins allowed to call /{owner}/{repo}/api-browser/* cross-origin with credentials (the
 # repos.js browser lane from another site). Exact origins or one leading `*.`; empty = no
 # cross-origin lane (no CORS headers).
@@ -82,8 +81,8 @@ force_path_style = false          # true for most self-hosted S3 implementations
 [store.gcs]
 endpoint = "https://storage.googleapis.com"  # gRPC endpoint; credentials = Application Default Credentials
 direct_connectivity = true
-# signing_service_account = "sa@project.iam.gserviceaccount.com"   # for bundles/lfs serve_via = "signed_url"
-bulk_clients = 4                  # separate data channels for pack/idx/side-file/bundle/LFS bytes + ranged reads
+# signing_service_account = "sa@project.iam.gserviceaccount.com"   # for lfs serve_via = "signed_url"
+bulk_clients = 4                  # separate data channels for pack/idx/side-file/LFS bytes + ranged reads
 bulk_concurrency = 32             # max concurrent bulk requests per process (control plane never queues behind them)
 
 [cache]
@@ -99,7 +98,6 @@ prewarm_parallelism = 2
 prewarm_ready_timeout = "0s"      # >0: /readyz answers 503 until prewarm finished (or this long)
 ref_advert_entries = 256          # max rendered ref advertisement cache entries
 object_info_entries = 4096        # max object info (size/has) cache entries
-bundle_list_entries = 128         # max bundle list render cache entries
 remote_block_bytes = "1GiB"       # pack-data block LRU for repos too large to materialize (range reads)
 remote_object_bytes = "256MiB"    # decoded-object LRU for the remote reader
 shared_render_cache = true        # mirror rendered sha-addressed API JSON into the store (all instances share)
@@ -141,107 +139,29 @@ follow_interval = "30s"           # upstream-follow loop (its own loop next to t
 [placement]
 serve = ["*"]                     # object work here: git-upload-pack, git-receive-pack, LFS transfer, pack prefetch/prewarm …
 serve_exclude = []                # … except these: 503 + Retry-After before any sync; refs-level reads (info/refs,
-                                  # ls-refs, API via the remote reader, UI, bundle list) stay available everywhere
-maintain = ["*"]                  # maintainer units here (with roles ∋ maintain): checkpoints, bundles, compaction, fsck/repair …
+                                  # ls-refs, API via the remote reader, UI) stay available everywhere
+maintain = ["*"]                  # maintainer units here (with roles ∋ maintain): checkpoints, compaction, fsck/repair …
 maintain_exclude = []             # … except these
 
-[compaction]
+[packs]
 enabled = true
-factor = 2                        # geometric repack factor
-trigger_packs = 16                # compact when this many tier-0 packs exist
-trigger_bytes = "1GiB"            # or when tier-0 pack bytes exceed this (either way: at least 2 fresh packs; the base/history
-                                  # pack are never folded; a base is rebuilt only by the weekly unit / `walgit compact --base`)
-lease_ttl = "10m"                 # compaction lease TTL
-retention_superseded = "7d"       # keep old packs for provenance / rewind
-engine = "git"                    # "git" (gix cannot delta-compress)
-
-# ---------------------------------------------------------------------------
-# bundle-uri strategies (docs/BUNDLE_URI_DESIGN.md §3-§4 is the design of record)
-#
-#   * `schedule` is a 6-field cron expression in UTC ("sec min hour dom mon dow"; "@weekly" /
-#     "@daily" / "@hourly" are aliases for the defaults below). Each fire time is a SLOT: the
-#     bundle's content is main (or `refs`) AS OF that instant — resolved from the WAL (highest
-#     seq with created_at <= slot) — and `creationToken` = the slot's epoch seconds. Slots are
-#     deterministic: a bundle for Tuesday 23:00 built on Thursday contains Tuesday's main.
-#   * Missing slots are BACKFILLED oldest-first on every maintainer pass (up to `backfill_max`
-#     per pass, 0 = unlimited), so an outage leaves no holes in the chain.
-#   * `kind = "full"` has no prerequisites; git downloads every listed bundle newer than the newest
-#     full on a clone and never walks past it. `kind = "incremental"` requires `base`: its
-#     prerequisites are the tips of the newest `base` bundle whose slot <= this slot.
-#   * Retention: `keep` on a full strategy = fulls listed; an incremental strategy without `chain`
-#     lists its 2 newest whose base is kept (the second keeps a client that read the list a slot
-#     ago from a 404 — git never retries a bundle download).
-#   * `chain = true` on an incremental: a slot is cut on this strategy's own previous bundle while
-#     that is newer than the newest base bundle (dailies chain from the weekly; hourlies restart
-#     from each daily); every slot since the base is listed and kept, each exactly its delta:
-#     more downloads, no overlapping bytes, a catch-up is exactly the slots missed.
-#   * Refs: `bundles.main_only = true` -> HEAD + refs/heads/main (+ `bundles.extra_refs` globs);
-#     false -> refs/heads/*, refs/tags/*, HEAD. A strategy's own `refs = [...]` overrides.
-#   * Full bundles of repos whose pack set does not fit an instance are a bucket-side compose of
-#     the tier-2 base pack (GCS: native; S3: multipart UploadPartCopy); incrementals are built
-#     from the local small packs. Every build is a task (…/tasks) and is narrated.
-#   * Two lists per repository: bundles/list (fulls + chain, for clones) and bundles/catchup (the
-#     chain without fulls, what clone recipes record in fetch.bundleURI).
-# ---------------------------------------------------------------------------
-[[bundles.strategy]]
-name = "weekly"
-kind = "full"
-schedule = "0 0 23 * * Sun"       # Sunday 23:00 UTC (= "@weekly")
-keep = 2                          # fulls listed
-backfill_max = 1                  # at most one missed weekly per pass
-# refs = ["HEAD", "refs/heads/main", "refs/tags/v*"]   # override the default ref set for this strategy
-# min_commits = 25                # override bundles.min_commits for this strategy (incrementals only)
-
-[[bundles.strategy]]
-name = "daily"
-kind = "incremental"
-base = "weekly"
-schedule = "0 0 23 * * *"         # every day 23:00 UTC (= "@daily")
-backfill_max = 0
-chain = true                      # each daily on the previous one (the first on the weekly): <= 7 listed, a catch-up
-                                  # downloads exactly the days missed
-
-[[bundles.strategy]]
-name = "hourly"
-kind = "incremental"
-base = "daily"
-schedule = "0 0 * * * *"          # every hour :00 UTC (= "@hourly")
-backfill_max = 48
-# chain = false                   # hourlies stay on the newest daily, 2 newest listed: a fresh clone is
-                                  # 1 weekly + <= 7 dailies + 2 hourlies, an hourly catch-up <= 2 bundles
-
-# The blobless family for `git clone --filter=blob:none` (design §6b): a chain of its own, same slots,
-# advertised ONLY at bundles/list?filter=blob:none (clients pass --bundle-uri=<that URL>). The full
-# one composes the history pack (commits + trees, no blobs); incrementals pack --filter=blob:none.
-# [[bundles.strategy]]
-# name = "weekly-history"
-# kind = "full"
-# schedule = "0 0 23 * * Sun"
-# keep = 2
-# backfill_max = 1
-# filter = "blob:none"             # only "blob:none"; every strategy of a chain shares the filter
-# [[bundles.strategy]]
-# name = "daily-history"
-# kind = "incremental"
-# base = "weekly-history"
-# schedule = "0 0 23 * * *"
-# filter = "blob:none"
-
-[bundles]
-min_commits = 25                  # don't cut an incremental slot with fewer commits since its base (plan: too-small; fulls never gated)
-min_bytes = "0B"                  # optional second guard on the incremental's pack size (0 = off)
-main_only = true                  # default bundle refs: HEAD + refs/heads/main (false: heads/* + tags/* + HEAD)
-extra_refs = []                   # e.g. ["refs/tags/v*"] added to every bundle's default ref set
-serve_via = "proxy"               # "proxy" (bytes through walgit or the edge) | "signed_url" (presigned bucket URLs in the list)
-signed_url_ttl = "1h"
-advertise = true                  # advertise bundle-uri in v2 capabilities
-advertise_filtered = false        # filtered families in the PLAIN list/advertisement too (filter = lines) — only for
-                                  # clients whose git matches bundle.<id>.filter (docs/patches); stock git would
-                                  # swallow blobless bundles into a full clone (design §6b)
-require = []                      # repos ("owner/name" | "owner/*") whose unbounded zero-have clones must use
-                                  # bundle-uri; shallow/filtered zero-have requests and fetches with haves proceed
-signed_url_for = []               # repos whose bundle URIs are presigned store URLs (clone bytes bypass the hosts); on any
-                                  # signing error the listing falls back to proxy URIs and warns once per repo
+geometric_factor = 2              # fold compatible fresh pack families independently
+fold_when_fresh_packs_reach = 16
+fold_when_max_age = "1d"           # zero disables the age arm
+fold_needs_at_least_packs = 2      # never fold one pack into itself
+                                  # byte trigger: max(live bytes / geometric_factor², packfile_uri.uri_min_bytes)
+segment_max_bytes = "2GiB"         # Git target, not an absolute cap for an oversized single object
+segment_target_bytes = "0B"        # zero derives from segment_max_bytes; otherwise 1MiB..=max
+segment_delta_window = 250
+segment_delta_depth = 50
+segment_delta_window_memory = "2GiB" # whole-operation budget, divided over explicit resolved threads
+segment_reuse_objects = true       # reuse compressed undeltified objects; whole cuts recompute deltas
+segment_threads = 0                # resolve available CPUs before invoking Git; host memory also clamps
+freeze_when_settled = "14d"         # useful fold freezes after settlement; zero disables age arm
+frozen_coverage_target = 0.75       # 0 disables first-freeze coverage trigger
+resegment_when_frozen_folds_exceed = 0.5 # fold-derived frozen bytes / previous global-cut bytes
+lease_ttl = "10m"
+# Retired pack bytes and URL authority have no time-based retention knob.
 
 [lfs]
 enabled = true
@@ -259,7 +179,7 @@ max_object_bytes = "16GiB"
                                                           # maintenance.follow_interval, published through the WAL as a push; fast-forward only
 
 [git]
-binary = "git"                    # path to upstream git binary (>= 2.47 recommended: pack.writeReverseIndex, bundle-uri)
+binary = "git"                    # path to upstream git binary (>= 2.47 recommended: pack.writeReverseIndex)
 upload_pack_engine = "auto"       # "auto" = stock git when packs are local/mount-linked, gix only for remote-served bases | "git" | "gix"
 allow_filter = true               # uploadpack.allowFilter
 allow_any_sha1_in_want = false    # uploadpack.allowAnySHA1InWant
@@ -282,3 +202,20 @@ lock_wait_warn = "1s"             # WARN "lock wait" (lock, repo, wait_ms, reque
 # webhook_url = "https://hooks.example.com/walgit"   # each batch of ref events is POSTed as a JSON array
 # webhook_secret = ""             # X-Walgit-Signature: sha256=<HMAC-SHA256 of the body>; unset = unsigned
 # sweep_interval = "5m"           # backstop + health check (warns when a sweep finds unpublished entries); 0 = off
+
+# Packfile foundations: these policies are validated and stored, but URI delivery and
+# ref filtering are not enabled by the foundation-only change.
+[refs]
+advertise = ["refs/heads/*", "refs/tags/*"] # discovery policy, independent of packing identity
+[refs.packfiles.code]
+kind = "code"                     # excludes metadata by kind, not an access control
+include = ["refs/*"]              # exact/trailing-prefix selectors; HEAD uses captured symbolic target
+subtract = []                     # code-group dependencies; complete same-generation proof required
+[refs.packfiles.meta]
+kind = "meta"
+include = ["refs/meta", "refs/meta/*"]
+subtract = []
+
+[packfile_uri]
+uri_min_bytes = "32MiB"           # at least one useful pack; smaller required companions may accompany it
+max_uris_per_fetch = 64           # complete sets only; over-cap selections fall back dynamically
diff --git a/walgit.standalone.toml b/walgit.standalone.toml
index 0bc1d13..6e6e395 100644
--- a/walgit.standalone.toml
+++ b/walgit.standalone.toml
@@ -4,21 +4,22 @@
 #   → https://walgit.localhost:8080/   (self-signed TLS; PORT=… moves it)
 #
 # Nothing in front of it: TLS, the web UI, the JSON API, smart HTTP (fetch/push),
-# bundle-uri and LFS bytes are all served by this process from the bucket below.
+# Git and LFS bytes are all served by this process from the bucket below.
 # An edge that wants to take work over announces it per request with
 # `X-Walgit-Capabilities: …` (`accel-redirect`, honoured only when
 # `server.accel_redirect = true`; see deploy/nginx.conf.example); hit directly,
 # walgit streams every byte itself.
 #
-# Prerequisites on this machine: `git` >= 2.46 (credential `authtype`, bundle URIs) and an
-# S3-compatible or GCS bucket. `just dev-store` starts rustfs in a container for local play.
+# Prerequisites on this machine: `git` >= 2.46 (credential `authtype`) and an
+# S3-compatible or GCS bucket. GNU coreutils (sort/comm) supports bounded pack planning.
+# `just dev-store` starts rustfs in a container for local play.
 # Every key not set here keeps the default documented in walgit.example.toml.
 
 [server]
 listen = "127.0.0.1:8080"                      # PORT env wins; also binds the ::1 twin
 public_url = "https://walgit.localhost:8080"   # browser origin; PORT rewrites the port
 auto_create_on_push = true                     # `git push` to a repository that does not exist yet creates it
-roles = []                                     # empty = every role: serve, maintain (checkpoints, bundles, compaction), events
+roles = []                                     # empty = every role: serve, maintain (checkpoints, compaction), events
 
 [server.tls]
 mode = "self_signed"              # generated once under <cache.dir>/tls/, published at /services/public/ca.pem.
@@ -67,32 +68,6 @@ force_path_style = true
 # bucket = "my-walgit-bucket"
 # prefix = ""
 
-# Bundles (docs/BUNDLE_URI_DESIGN.md): one weekly full, then **chained** incrementals — each daily on the
-# previous daily (the first on the weekly), each hourly on the previous hourly (restarting from every new
-# daily). The list carries 1 weekly + <= 7 dailies + <= 24 hourlies, every one exactly its delta; git's
-# creationToken heuristic downloads them newest-first until one whose prerequisites it has, so a catch-up
-# is exactly the slots missed. walgit.example.toml has the other shape (every incremental on its base).
-[[bundles.strategy]]
-name = "weekly"
-kind = "full"
-schedule = "0 0 23 * * Sun"
-keep = 1
-backfill_max = 1
-
-[[bundles.strategy]]
-name = "daily"
-kind = "incremental"
-base = "weekly"
-schedule = "0 0 23 * * *"
-chain = true
-
-[[bundles.strategy]]
-name = "hourly"
-kind = "incremental"
-base = "daily"
-schedule = "0 0 * * * *"
-chain = true
-
 [cache]
 dir = "/tmp/walgit"               # materialized repositories + tls/; wiped = warmth lost, nothing else
 max_bytes = "20GiB"
diff --git a/web/API.md b/web/API.md
index d0c27f4..147dee4 100644
--- a/web/API.md
+++ b/web/API.md
@@ -61,10 +61,10 @@ lane segment (e.g. `/{owner}/{repo}/api2/…`) without infrastructure work.
 | Page routes | Every UI route below MUST return `web/dist/index.html` (`text/html; charset=utf-8`, `Cache-Control: no-cache`) so deep links and reloads work: `/`, `/{owner}`, `/{owner}/{repo}`, `/{owner}/{repo}/tree/*`, `/{owner}/{repo}/blob/*`, `/{owner}/{repo}/commits`, `/{owner}/{repo}/commits/*`, `/{owner}/{repo}/commit/*`, `/{owner}/{repo}/wal`, `/{owner}/{repo}/settings`, and `/api` (the "API" docs page in the UI; `?repo=owner/name` pre-fills its examples; `/api/v1` itself is the JSON discovery document). |
 | API base | **`/{owner}/{repo}/api`** (bearer / same-origin cookie) and **`/{owner}/{repo}/api-browser`** (cross-origin browser), D15/D26/D27: one path prefix per repository, so the edge routes e.g. `acme/monorepo` to its host. Non-repo: `/api/v1` (discovery, `me`, `authenticate`, `owners`), `/services/api/owners*`, `/services/api/instance`. The bundled UI fetches same-origin with the session cookie and `Accept: application/json, text/event-stream`. No aliases or application sessions. |
 | Public lane | **`/services/public/*`** — the one open prefix besides health and the SDK (nginx skips `auth_request` there; the app never authenticates here and never reads repo data). Today exactly `/services/public/install.sh[?repo=owner/name]` (`text/x-shellscript`, `Cache-Control: public, max-age=300`); plus `/services/public/ca.pem` (the certificate this process presents when it terminates TLS itself, `application/x-pem-file`, D39; 404 behind an edge); anything else under it is 404. |
-| Setup | `/services/setup.json[?repo=owner/name]` — the clone/setup recipes (`setup::Recipes`: `token_url`, `install`, `install_url`, `plain_clone`, `blobless_clone`, `bundle_list`, `manual_clone`, `setup_text`, and `ca_url` + `trust` when the host terminates self-signed TLS itself — D39), `no-cache`; `/services/public/install.sh[?repo=]` — the one-time installer (open lane, AGENTS §1.3) (POSIX sh). The Clone menu and the API page render these, never their own copies. |
+| Setup | `/services/setup.json[?repo=owner/name]` — the clone/setup recipes (`setup::Recipes`: `token_url`, `install`, `install_url`, `plain_clone`, `blobless_clone`, `manual_clone`, `setup_text`, and `ca_url` + `trust` when the host terminates self-signed TLS itself — D39), `no-cache`; `/services/public/install.sh[?repo=]` — the one-time installer (open lane, AGENTS §1.3) (POSIX sh). The Clone menu and the API page render these, never their own copies. |
 | Auth | `/_auth/login?next=`, `/_auth/callback`, `/_auth/logout`, `/_auth/me`, `/_auth/check` (an `auth_request` target for an edge), `/_auth/tokens` (GET: the token page; POST: mint a walgit access token for the signed-in principal, `{token, principal, write, expires_at}`, same-origin only) — in-app OIDC sign-in + session cookie. Off until `session_secret` + the OAuth client are set. |
 | SDK | `/repos.js` (IIFE, registers `window.repos`) and `/repos.mjs` (ESM), built from `web/sdk/repos.ts` into `web/dist/` by `pnpm run build`; `no-cache` + strong ETag, precompressed. These data-free routes are open at the application. |
-| Dev | `vite dev` proxies `/api/`, `/api-browser/`, `/services/api/` and `/{owner}/{repo}/api[-browser]/…` (plus git/bundle paths) to `$WALGIT_URL` (default `http://127.0.0.1:8080`). |
+| Dev | `vite dev` proxies `/api/`, `/api-browser/`, `/services/api/` and `/{owner}/{repo}/api[-browser]/…` (plus git paths) to `$WALGIT_URL` (default `http://127.0.0.1:8080`). |
 
 Path segments in URLs are `encodeURIComponent`-encoded per segment by the
 client (`enc()` in `api.ts`); `/` between segments is literal. Servers must
@@ -192,7 +192,7 @@ Anything long-running is a **task** with a unique id, discoverable per repo:
 `TaskRecord`: `{id, kind, repo, hostname, started, finished?, elapsed_ms,
 ok?: bool, summary, progress?: {label,done,total?,unit,percent?},
 log_tail: [string], params?: {…}}`; `ok` absent = running. Kinds today:
-`materialize`, `remote-index`, `fsck`, `compact`, `bundle`, `checkpoint`,
+`materialize`, `remote-index`, `fsck`, `compact`, `checkpoint`,
 `sync`, `rematerialize`.
 
 ## 3. Ref + path resolution (`{rest...}` routes)
@@ -265,12 +265,12 @@ removes it (admin permission) — the same handlers as `PUT|DELETE /{owner}/{rep
 `GET|PUT|DELETE …/policy` is the push policy document (`docs/POLICY.md`).
 
 `GET|PUT|DELETE /{o}/{r}/api/settings` (D24, 2026-08-21) is the repository's **settings in the WAL**: a TOML document
-restricted to `[bundles]`, `[maintenance]`, `[compaction]` and `[upstream]`, merged over the
+restricted to `[refs]`, `[packfile_uri]`, `[maintenance]`, `[packs]` and `[upstream]`, merged over the
 host's config (`effective config`).
 `GET` → `{revision, author, updated_at, message, toml}` (`revision: 0` = none). `PUT` body = the TOML
 (`?message=` optional), validated against the serving host's build — 400 with the reason and nothing published
 on failure; 200 `{revision}`. `DELETE` publishes an empty document. `GET …/settings/effective` → the effective
-`[bundles]`/`[maintenance]`/`[compaction]`/`[upstream]` as TOML (`application/toml`; no host secrets,
+allowed sections as TOML (`application/toml`; no host secrets,
 no `token_env`); `GET …/settings/history` → `{min_seq, entries:[{seq,revision,author,message,
 at,toml}]}` from the live log (older changes are folded into checkpoints). All `no-store`; PUT/DELETE need
 **admin** (`tokens[].admin` or oidc `admin_emails`/`admin_domains`; `mode = none` is admin on loopback).
@@ -278,8 +278,8 @@ Every instance sees a new revision on its next refs-level sync (no extra round t
 inline on `manifest.pb`). CLI: `walgit repo settings show|set|clear|history`.
 
 Settings tab helpers (`/{o}/{r}/api/settings…`, all `no-store`): `GET …/settings/describe` → `{settings, sections,
-strategies:[{name,kind,base,schedule,schedule_human,next,keep,backfill_max,min_commits,refs}], bundles, maintenance:
-{checkpoints,interval_secs,this_host:{name,serves,maintains,disk,max_pack_bytes,cache_budget_bytes,roles}}, compaction,
+maintenance:
+{checkpoints,interval_secs,this_host:{name,serves,maintains,disk,max_pack_bytes,cache_budget_bytes,roles}}, packs{enabled,fold_when_fresh_packs_reach,fold_when_max_age_secs,segment_max_bytes,freeze_when_settled_secs},
 upstream:{git,lfs,token_env:bool,follow:[refs],follow_interval_secs,last_round:{at,outcome: in-sync|published|refused|failed,
 detail,upstream:{ref:oid},ours:{ref:oid}}|null} (D33; last_round = this instance's last follow round),
 fields:[{key,value,host_value,source: host|setting}], head_seq}`; `POST …/settings/validate` (body TOML) → the same
@@ -468,13 +468,10 @@ WAL should return `404` (the tab then shows the error text). Shape is in
 `health{status: ok|degraded|error, issues[], deep, suggestions[{op, params?, reason, auto?}]}` — `deep` is the
 last connectivity audit as recorded in the store (`fsck.pb`, any maintainer), `auto` says how/when the
 maintainer loop performs a suggestion by itself (absent = a human must) — `manifest{version,
-next_seq, min_seq, segments[], tail_entries, entries, checkpoint?,
-packset?, advertised_bundle_uri?, last_push?}`, `local{version, next_seq,
+next_seq, min_seq, segments[], tail_entries, entries,
+packset?, last_push?}`, `local{version, next_seq,
 bootstrap, reconciled, size_bytes}`, `packs{live, live_bytes, pushes}`,
-`bundles[{sha, size, at_seq, created, uri, strategy, kind, base_id, creation_token, filter, tips}]` (the chain:
-`base_id` is the bundle whose tips are this one's prerequisites, `""` for a full), `bundle_plan{slots[{strategy,
-kind, slot, status: built|missing|pending|blocked|unavailable|too-small|skipped|wrong-host, detail, bundle_id}],
-upcoming[], maintainers[{host, disk, max_pack_bytes, last_pass_age_secs, alive, passes, last_unit}], orphaned}`,
+`maintenance{maintainers[{host, disk, max_pack_bytes, last_pass_age_secs, alive, passes, last_unit}], orphaned}`,
 `compactions[]`, `node{…counters}`. Arrays `[]` when empty.
 
 ### Service routes (not for the browser)
diff --git a/web/sdk/repos.ts b/web/sdk/repos.ts
index 1dbdee8..777800e 100644
--- a/web/sdk/repos.ts
+++ b/web/sdk/repos.ts
@@ -177,7 +177,7 @@ export interface OpSpec {
 }
 export interface OpRecord {
   id: string;
-  /** The task kind (fsck, compact, bundle, checkpoint, materialize, …) — the wire field is `kind`. */
+  /** The task kind (fsck, compact, checkpoint, materialize, …) — the wire field is `kind`. */
   kind: string;
   repo: string;
   hostname: string;
@@ -199,7 +199,7 @@ export type Overview = Record<string, unknown> & {
   clone_url: string;
   hostname: string;
   health: { status: "ok" | "degraded" | "error"; issues: string[]; deep: string };
-  ops: { available: OpSpec[]; recent: OpRecord[]; bundle_strategies: string[] };
+  ops: { available: OpSpec[]; recent: OpRecord[] };
 };
 /** One `/policy` document (docs/POLICY.md). */
 export type Policy = Record<string, unknown>;
@@ -714,7 +714,7 @@ export class RepoClient {
       }),
   };
 
-  /** D24: WAL-backed TOML overrides of [bundles], [maintenance], [compaction] and [upstream]. */
+  /** WAL-backed TOML overrides, including ref/group and pack delivery policy. */
   readonly settings = {
     /** The settings document (`revision: 0` = none). */
     get: (opts?: CallOptions) => this.client.json<RepoSettings>(`${this.p}/settings`, opts),
@@ -731,7 +731,7 @@ export class RepoClient {
     effective: (opts?: CallOptions) => this.client.text(`${this.p}/settings/effective`, opts),
     /** SETTINGS entries in the live log, oldest first. */
     history: (opts?: CallOptions) => this.client.json<SettingsHistory>(`${this.p}/settings/history`, opts),
-    /** Everything the Settings tab shows: strategies with next fire, placement, fields with sources. */
+    /** Effective placement and configuration fields with their sources. */
     describe: (opts?: CallOptions) => this.client.json<SettingsDescribe>(`${this.p}/settings/describe`, opts),
     /** Validate a document and preview the resulting effective config, without publishing. */
     validate: (toml: string, opts?: CallOptions) =>
@@ -754,21 +754,6 @@ export interface SettingsHistory {
   min_seq: number;
   entries: { seq: number; revision: number; author: string; message: string; at: string | null; toml: string }[];
 }
-export interface StrategyInfo {
-  name: string;
-  kind: "full" | "incremental";
-  base: string | null;
-  schedule: string;
-  schedule_human: string;
-  next: string | null;
-  keep: number;
-  backfill_max: number;
-  min_commits: number;
-  refs: string[];
-  /** Incrementals: cut on this strategy's previous bundle (chained) instead of the base's newest. */
-  chain: boolean;
-  filter: string | null;
-}
 export interface SettingsField {
   key: string;
   value: unknown;
@@ -779,14 +764,12 @@ export interface SettingsDescribe {
   repo: string;
   settings: RepoSettings | { revision: 0; toml: "" };
   sections: string[];
-  strategies: StrategyInfo[];
-  bundles: { enabled: boolean; min_commits: number; main_only: boolean };
   maintenance: {
     checkpoints: boolean;
     interval_secs: number;
     this_host: { name: string; serves: boolean; maintains: boolean; disk: string; max_pack_bytes: number; cache_budget_bytes: number; roles: string[] };
   };
-  compaction: { enabled: boolean; trigger_packs: number; trigger_bytes: number };
+  packs: { enabled: boolean; fold_when_fresh_packs_reach: number; fold_when_max_age_secs: number; segment_max_bytes: number; freeze_when_settled_secs: number };
   /** D33: what this repository follows (`[upstream] follow`) and the last round on the answering instance. */
   upstream: {
     git: string | null;
diff --git a/web/src/api.ts b/web/src/api.ts
index fa59038..f3abcdc 100644
--- a/web/src/api.ts
+++ b/web/src/api.ts
@@ -30,7 +30,7 @@ export type {
   Me,
 } from "../sdk/repos";
 import type { RefInfo, OpEvent, OpSpec, OpRecord, Tasks } from "../sdk/repos";
-export type { SettingsDescribe, SettingsValidation, SettingsHistory, StrategyInfo, SettingsField, Policy, PolicyValidation, PolicyDryRun, RepoSettings } from "../sdk/repos";
+export type { SettingsDescribe, SettingsValidation, SettingsHistory, SettingsField, Policy, PolicyValidation, PolicyDryRun, RepoSettings } from "../sdk/repos";
 
 /** Kept for callers: the SDK's error class under the UI's historical name. */
 export const ApiError = ReposError;
@@ -127,32 +127,14 @@ export interface SetupRecipes {
   install_url: string;
   manual_clone: string;
   plain_clone: string;
-  /** Blobless + sparse from the blobless bundle family, fetches on it too (`fetch.bundleURI`). */
+  /** Blobless + sparse: full history with blobs fetched on demand. */
   blobless_clone: string;
-  /** The repository's unfiltered bundle list URL. */
-  bundle_list: string;
   setup_text: string;
   /** Self-signed TLS: the CA to pin and the one-liner that does it (null behind a public certificate). */
   ca_url: string | null;
   trust: string | null;
 }
 
-export interface BundleInfo {
-  sha: string;
-  size: number;
-  at_seq: number;
-  created: string;
-  creator: string;
-  uri: string;
-  /** Chain facts (empty on the checkpoint bundle). */
-  strategy: string;
-  kind: string;
-  /** The bundle whose tips are this one's prerequisites ("" for a full). */
-  base_id: string;
-  creation_token: number;
-  filter: string;
-  tips: [string, string][];
-}
 export interface Overview {
   repo: string;
   instance: { kind: string; name: string; revision: string; instance: string; version: string; roles: string[]; disk: string; shape: string; cpus: number; memory_bytes: number };
@@ -165,7 +147,7 @@ export interface Overview {
     deep: string;
     suggestions: { op: string; params?: string; reason: string; auto?: string }[];
   };
-  ops: { available: OpSpec[]; recent: OpRecord[]; bundle_strategies: string[] };
+  ops: { available: OpSpec[]; recent: OpRecord[] };
   /** `sh -c "$(curl -fsSL …/services/public/install.sh)"` (open route; stdin stays the terminal for the token prompt). */
   install: string;
   /** Absolute URL of the installer. */
@@ -178,17 +160,12 @@ export interface Overview {
     segments: { key: string; first_seq: number; last_seq: number; size: number }[];
     tail_entries: number;
     entries: number;
-    checkpoint?: BundleInfo;
     packset?: { at_seq: number; packs: number; bytes: number; created: string; creator: string };
-    advertised_bundle_uri?: string;
     last_push?: string;
   };
   local: { version: string; next_seq: number; bootstrap: number; reconciled: boolean; size_bytes: number };
   packs: { live: number; live_bytes: number; pushes: number };
-  bundles: BundleInfo[];
-  bundle_plan: {
-    slots: { strategy: string; kind: string; slot: number; status: "built" | "missing" | "pending" | "blocked" | "unavailable" | "too-small" | "skipped" | "wrong-host"; detail: string; bundle_id: string | null }[];
-    upcoming: { strategy: string; kind: string; slot: number; unit: string; host: string | null }[];
+  maintenance: {
     maintainers: { host: string; disk: string; max_pack_bytes: number; last_pass_age_secs: number | null; alive: boolean; passes: number; last_unit: string }[];
     orphaned: boolean;
   };
diff --git a/web/src/components/BundleChain.tsx b/web/src/components/BundleChain.tsx
deleted file mode 100644
index 3b16c62..0000000
--- a/web/src/components/BundleChain.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import type { BundleInfo } from "../api";
-
-const fmtBytes = (n: number) => {
-  if (n < 1024) return `${n} B`;
-  const u = ["KB", "MB", "GB", "TB"];
-  let v = n / 1024;
-  let i = 0;
-  while (v >= 1024 && i < u.length - 1) {
-    v /= 1024;
-    i++;
-  }
-  return `${v.toFixed(1)} ${u[i]}`;
-};
-const byToken = (a: BundleInfo, b: BundleInfo) => a.creation_token - b.creation_token;
-const slotTime = (s: number) => new Date(s * 1000).toISOString().slice(0, 16).replace("T", " ") + "Z";
-
-/**
- * The published bundles as the chain git walks: every full is a root; an incremental hangs under
- * the bundle whose tips are its prerequisites (`base_id`) — the previous link of its own strategy
- * when chained, else its base strategy's newest. git's creationToken heuristic downloads from the
- * newest token down until a bundle whose prerequisites it already has, so a fresh clone is the
- * whole tree and a catch-up is the links above what the client has.
- */
-export function BundleChain({ bundles }: { bundles: BundleInfo[] }) {
-  const listed = bundles.filter((b) => b.strategy);
-  if (listed.length === 0) return <div className="muted pad">No bundles cut yet.</div>;
-  const byId = new Map(listed.map((b) => [b.sha, b]));
-  const children = new Map<string, BundleInfo[]>();
-  const roots: BundleInfo[] = [];
-  for (const b of listed) {
-    if (b.base_id && byId.has(b.base_id)) {
-      const c = children.get(b.base_id) ?? [];
-      c.push(b);
-      children.set(b.base_id, c);
-    } else {
-      roots.push(b);
-    }
-  }
-  const sortedRoots = roots.toSorted(byToken);
-  for (const [k, c] of children) children.set(k, c.toSorted(byToken));
-  const families = new Set(listed.map((b) => b.filter || ""));
-  const total = listed.reduce((n, b) => n + b.size, 0);
-
-  const render = (b: BundleInfo, depth: number, last: boolean): React.ReactNode => {
-    const kids = children.get(b.sha) ?? [];
-    const isRoot = depth === 0;
-    return (
-      <div key={b.sha} className="chain-node" style={{ marginLeft: depth * 22 }}>
-        <div className={`chain-row ${isRoot ? "chain-root" : ""}`}>
-          <span className="chain-edge" aria-hidden="true">
-            {isRoot ? "●" : last ? "└─" : "├─"}
-          </span>
-          <span className={`pill ${b.kind}`}>{b.strategy}</span> <code>{slotTime(b.creation_token)}</code>
-          <span className="muted small">
-            {" "}
-            · {fmtBytes(b.size)} · seq {b.at_seq}
-            {b.filter ? ` · ${b.filter}` : ""}
-            {isRoot ? " · no prerequisites: a clone starts here" : ` · prerequisites = tips of the ${byId.get(b.base_id)?.strategy} above`}
-          </span>{" "}
-          <a className="small" href={b.uri} title={b.tips.map(([n, o]) => `${n} ${o.slice(0, 12)}`).join("\n")}>
-            download
-          </a>
-        </div>
-        {kids.map((k, i) => render(k, depth + 1, i === kids.length - 1))}
-      </div>
-    );
-  };
-
-  return (
-    <div className="pad chain">
-      <div className="small muted" style={{ marginBottom: 6 }}>
-        {listed.length} bundle{listed.length === 1 ? "" : "s"} · {fmtBytes(total)} listed
-        {families.size > 1 ? ` · ${families.size} families (plain, ${[...families].filter(Boolean).join(", ")})` : ""} — a fresh clone downloads the
-        whole tree newest-first; a catch-up only the links above what it has.
-      </div>
-      {sortedRoots.map((r) => render(r, 0, true))}
-      {listed.some((b) => b.base_id && !byId.has(b.base_id)) && (
-        <div className="small warn" style={{ marginTop: 6 }}>
-          Some incrementals point at a base that is no longer listed — a client that read the list a slot ago may 404 mid-chain (git never
-          retries a bundle download).
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/web/src/components/BundlePlan.tsx b/web/src/components/BundlePlan.tsx
deleted file mode 100644
index c91d3eb..0000000
--- a/web/src/components/BundlePlan.tsx
+++ /dev/null
@@ -1,148 +0,0 @@
-import { useState } from "react";
-import type { Overview } from "../api";
-import { Maintainers } from "./Maintainers";
-
-type Slot = Overview["bundle_plan"]["slots"][number];
-
-const slotTime = (s: number) => new Date(s * 1000).toISOString().slice(0, 16).replace("T", " ") + "Z";
-
-/** Statuses that mean "somebody has to do something" — shown one per row. */
-const ACTIONABLE = new Set<Slot["status"]>(["missing", "pending", "blocked", "wrong-host"]);
-
-/**
- * The slot table as a plan, not a log: per strategy one line of settled history (built / skipped /
- * too-small / unavailable as counts, expandable) and every slot that still needs work on its own
- * row. Who can do the work (the maintainers) and what the next slot of each strategy will be.
- */
-export function BundlePlan({ plan }: { plan: Overview["bundle_plan"] }) {
-  const [open, setOpen] = useState<Record<string, boolean>>({});
-  const strategies = [...new Set(plan.slots.map((r) => r.strategy))];
-  return (
-    <>
-      <div className="pad">
-        <Maintainers list={plan.maintainers} orphaned={plan.orphaned} />
-      </div>
-      {plan.upcoming?.length > 0 && (
-        <div className="pad small">
-          <strong>Next slots</strong>
-          <table className="kv compact">
-            <tbody>
-              {plan.upcoming.map((u) => (
-                <tr key={u.strategy} className={u.host ? "" : "warn"}>
-                  <th>{u.strategy}</th>
-                  <td>
-                    <code>{slotTime(u.slot)}</code> → {u.unit}
-                    {!u.host && <span className="pill stale"> no live maintainer</span>}
-                  </td>
-                </tr>
-              ))}
-            </tbody>
-          </table>
-        </div>
-      )}
-      {plan.slots.length === 0 ? (
-        <div className="muted pad">No slots planned (bundles disabled or no strategies).</div>
-      ) : (
-        <table className="grid">
-          <thead>
-            <tr>
-              <th>strategy</th>
-              <th>slots</th>
-              <th>detail</th>
-            </tr>
-          </thead>
-          <tbody>
-            {strategies.map((name) => {
-              const rows = plan.slots.filter((r) => r.strategy === name);
-              const settled = rows.filter((r) => !ACTIONABLE.has(r.status));
-              const work = rows.filter((r) => ACTIONABLE.has(r.status));
-              const counts = new Map<string, number>();
-              for (const r of settled) counts.set(r.status, (counts.get(r.status) ?? 0) + 1);
-              const key = `settled:${name}`;
-              return (
-                <SlotGroup key={name} name={name} kind={rows[0]?.kind ?? ""} settled={settled} counts={counts} work={work} open={!!open[key]} toggle={() => setOpen({ ...open, [key]: !open[key] })} />
-              );
-            })}
-          </tbody>
-        </table>
-      )}
-      <div className="pad small muted">
-        A slot is the schedule's fire time; its bundle holds main as of that instant (token = slot epoch). <span className="pill pending">pending</span> =
-        fired in the last 2 minutes (a writer's entry may still land); <span className="pill missing">missing</span> = work for the next pass, oldest
-        first; <span className="pill skipped">skipped</span> = measured closed with nothing new, recorded so nobody re-measures it.
-      </div>
-    </>
-  );
-}
-
-function SlotGroup({
-  name,
-  kind,
-  settled,
-  counts,
-  work,
-  open,
-  toggle,
-}: {
-  name: string;
-  kind: string;
-  settled: Slot[];
-  counts: Map<string, number>;
-  work: Slot[];
-  open: boolean;
-  toggle: () => void;
-}) {
-  const built = settled.filter((r) => r.status === "built");
-  const newest = built.at(-1);
-  return (
-    <>
-      <tr>
-        <td>
-          <strong>{name}</strong> <span className="muted small">{kind}</span>
-        </td>
-        <td className="small">
-          {[...counts.entries()].map(([st, n]) => (
-            <span key={st} className={`pill ${st}`} style={{ marginRight: 4 }}>
-              {n} {st}
-            </span>
-          ))}
-          {settled.length > 0 && (
-            <button className="btn link small" onClick={toggle}>
-              {open ? "hide" : "show"}
-            </button>
-          )}
-        </td>
-        <td className="small muted">
-          {newest ? (
-            <>
-              newest built <code>{slotTime(newest.slot)}</code> ({newest.detail})
-            </>
-          ) : (
-            "nothing built yet"
-          )}
-        </td>
-      </tr>
-      {open &&
-        settled.map((r) => (
-          <tr key={`${r.strategy}-${r.slot}`} className="muted">
-            <td />
-            <td>
-              <code>{slotTime(r.slot)}</code> <span className={`pill ${r.status}`}>{r.status}</span>
-            </td>
-            <td className="small">
-              {r.bundle_id ? <code>{r.bundle_id}</code> : null} {r.detail}
-            </td>
-          </tr>
-        ))}
-      {work.map((r) => (
-        <tr key={`${r.strategy}-${r.slot}`} className={r.status === "missing" ? "warn" : ""}>
-          <td />
-          <td>
-            <code>{slotTime(r.slot)}</code> <span className={`pill ${r.status}`}>{r.status}</span>
-          </td>
-          <td className="small">{r.detail || (r.status === "missing" ? "next pass builds it" : "")}</td>
-        </tr>
-      ))}
-    </>
-  );
-}
diff --git a/web/src/components/CloneSetup.tsx b/web/src/components/CloneSetup.tsx
index 7e6141b..4119903 100644
--- a/web/src/components/CloneSetup.tsx
+++ b/web/src/components/CloneSetup.tsx
@@ -35,8 +35,7 @@ export function CloneSetup({ repo, compact = false }: { repo: string; compact?:
             )
           </>
         )}
-        , stores it in a file only you can read, installs a git credential helper that hands it to git, configures
-        bundle URIs and clones. Idempotent: re-run any time. Needs git ≥ 2.46 and curl.
+        , stores it in a file only you can read, installs a git credential helper that hands it to git, and clones. Idempotent: re-run any time. Needs git ≥ 2.46 and curl.
       </div>
       <CodeSample code={r.install} />
       <div className="small strong">Already set up</div>
@@ -51,27 +50,21 @@ export function CloneSetup({ repo, compact = false }: { repo: string; compact?:
       </div>
       {!compact && (
         <p className="small muted">
-          Initial clones bootstrap from immutable static bundles (bundle-uri); upload-pack only sends the remainder.
-          Every recipe passes <code>-c fetch.bundleURI=…/bundles/catchup</code> (the list without the fulls: a fetch only
-          ever needs incremental links): git records no list for an advertised
-          bundle-uri clone, and without it later <code>git fetch</code>es would skip the bundles. The installer sets
-          <code>transfer.bundleURI=true</code> and <code>fetch.uriProtocols=https</code> globally. When the server rejects the
+          The credential helper authenticates clones, fetches and pushes. When the server rejects the
           token (a real 401) git erases it from the helper, which tells you where to get a new one.
         </p>
       )}
       {!compact && (
         <>
           <p className="small muted">
-            <strong>Blobless clone</strong> (full history, blobs on demand — the developer shape): git does not match bundle
-            filters itself, so point it at the blobless bundle list explicitly. Keep <code>--sparse</code>: a full checkout
+            <strong>Blobless clone</strong> (full history, blobs on demand): keep <code>--sparse</code>: a full checkout
             would ask for every blob of HEAD's tree at once (minutes of server time); add areas with{" "}
             <code>git sparse-checkout add</code>.
           </p>
           <CodeSample code={r.blobless_clone} />
           <p className="small muted">
-            <strong>CI / shallow clones</strong> (<code>--depth</code>, <code>--single-branch</code>): pass{" "}
-            <code>-c transfer.bundleURI=false</code> — git otherwise downloads the full weekly bundle first (the whole
-            base pack of a large repository) even though the clone is bounded; upload-pack answers those in seconds.
+            <strong>CI / shallow clones</strong>: use <code>--depth=1 --single-branch</code>
+            when the job only needs the current branch tip.
           </p>
         </>
       )}
diff --git a/web/src/components/Maintainers.tsx b/web/src/components/Maintainers.tsx
index 28cbb85..99564f5 100644
--- a/web/src/components/Maintainers.tsx
+++ b/web/src/components/Maintainers.tsx
@@ -1,6 +1,6 @@
 import type { Overview } from "../api";
 
-type M = Overview["bundle_plan"]["maintainers"][number];
+type M = Overview["maintenance"]["maintainers"][number];
 
 /** Alive within 10 min (the heartbeat is one per pass, a pass is ≤ 60 s). */
 const ALIVE_SECS = 600;
@@ -35,7 +35,7 @@ export function Maintainers({ list, orphaned, label = true }: { list: M[]; orpha
     <div className="maintainers small">
       {orphaned && (
         <div className="flash error" role="alert">
-          Nobody maintains this repository right now: no maintainer has passed in the last {ALIVE_SECS / 60} minutes. Checkpoints, bundles and
+          Nobody maintains this repository right now: no maintainer has passed in the last {ALIVE_SECS / 60} minutes. Checkpoints and
           compaction wait until one is back.
         </div>
       )}
diff --git a/web/src/components/TasksOverlay.tsx b/web/src/components/TasksOverlay.tsx
index 98f7c30..c9a6a35 100644
--- a/web/src/components/TasksOverlay.tsx
+++ b/web/src/components/TasksOverlay.tsx
@@ -14,7 +14,7 @@ function kindLabel(kind: string): string {
 
 /**
  * What the serving instance is doing to this repository right now
- * (materializing packs, indexing remote packs, checkpoint, bundle…), as a
+ * (materializing packs, indexing remote packs, checkpoint…), as a
  * compact indicator in the repo header: spinner + the name of the job (+N
  * more) + its percent. Clicking it opens a dropdown with every running task,
  * its latest progress, and the tasks that just finished. Polls `…/tasks`
diff --git a/web/src/pages/ApiPage.tsx b/web/src/pages/ApiPage.tsx
index 5361efd..7db4521 100644
--- a/web/src/pages/ApiPage.tsx
+++ b/web/src/pages/ApiPage.tsx
@@ -134,7 +134,7 @@ export function ApiPage() {
               desc={<>Per-repository settings in the WAL (<code>GET</code> read; <code>PUT</code>/<code>DELETE</code> admin); also <code>/effective</code>, <code>/history</code>, <code>/describe</code> and <code>POST /validate</code>.</>}
               cache="no-store"
             />
-            <Row path={`/${r}/api/overview`} desc="WAL health, manifest, packs, bundles (what the WAL tab shows)." cache="no-store" />
+            <Row path={`/${r}/api/overview`} desc="WAL health, manifest, packs (what the WAL tab shows)." cache="no-store" />
             <Row
               path={`/${r}/api/tasks · /tasks/{id} · POST /ops/{op}`}
               desc={<>What the answering instance is doing to the repo (<code>{`{hostname,running,recent}`}</code>); attach to a task or start a maintenance op (write) as an SSE stream.</>}
diff --git a/web/src/pages/OverviewPage.tsx b/web/src/pages/OverviewPage.tsx
index 478db81..135ff90 100644
--- a/web/src/pages/OverviewPage.tsx
+++ b/web/src/pages/OverviewPage.tsx
@@ -2,8 +2,6 @@ import { useCallback, useEffect, useRef, useState, type ReactNode } from "react"
 import { api, runOp, type OpEvent, type OpRecord, type Overview } from "../api";
 import { invalidate, useData } from "../data";
 import { Box } from "../components/Layout";
-import { BundlePlan } from "../components/BundlePlan";
-import { BundleChain } from "../components/BundleChain";
 import { useRepo } from "./RepoLayout";
 
 const fmtBytes = (n: number) => {
@@ -16,7 +14,6 @@ const fmtBytes = (n: number) => {
   return `${n.toFixed(i ? 1 : 0)} ${u[i]}`;
 };
 const fmtTime = (s?: string) => (s && !s.startsWith("1970") ? new Date(s).toLocaleString() : "—");
-const short = (s: string) => s.slice(0, 12);
 
 function KV({ rows }: { rows: [string, ReactNode][] }) {
   return (
@@ -102,8 +99,6 @@ export function OverviewPage() {
               ["sealed segments", m.segments.length],
               ["inline tail", m.tail_entries],
               ["last push", fmtTime(m.last_push)],
-              // oxlint-disable-next-line react/jsx-key
-              ["advertised bundle", m.advertised_bundle_uri ? <code className="wrap">{m.advertised_bundle_uri}</code> : "—"],
             ]}
           />
         </Box>
@@ -149,29 +144,11 @@ export function OverviewPage() {
                   ? `at_seq ${m.packset.at_seq}, ${m.packset.packs} pack(s), ${fmtBytes(m.packset.bytes)}, ${fmtTime(m.packset.created)} by ${m.packset.creator}`
                   : "—",
               ],
-              [
-                "bundle",
-                m.checkpoint ? (
-                  <>
-                    at_seq {m.checkpoint.at_seq}, {fmtBytes(m.checkpoint.size)}, <code>{short(m.checkpoint.sha)}</code>
-                  </>
-                ) : (
-                  "—"
-                ),
-              ],
             ]}
           />
         </Box>
       </div>
 
-      <Box title={`Bundle chain (${o.bundles.length} listed)`}>
-        <BundleChain bundles={o.bundles} />
-      </Box>
-
-      <Box title="Bundle slots (what the maintainer will cut next)">
-        <BundlePlan plan={o.bundle_plan} />
-      </Box>
-
       <Box title={`Compactions (${o.compactions.length})`}>
         {o.compactions.length === 0 ? (
           <div className="muted pad">No compactions yet.</div>
@@ -228,7 +205,6 @@ function OpsBox({ repo, overview, onChanged }: { repo: string; overview: Overvie
   const [log, setLog] = useState<string[]>([]);
   const [status, setStatus] = useState<{ ok?: boolean; text: string } | null>(null);
   const [flags, setFlags] = useState<Record<string, boolean>>({});
-  const [strategy, setStrategy] = useState<string>("");
   const abort = useRef<AbortController | null>(null);
   const logRef = useRef<HTMLPreElement>(null);
 
@@ -285,8 +261,7 @@ function OpsBox({ repo, overview, onChanged }: { repo: string; overview: Overvie
 
   const paramsFor = (op: string, spec: { params: string[] }) => {
     const p: Record<string, string> = {};
-    for (const k of spec.params) if (k !== "strategy" && flags[`${op}.${k}`]) p[k] = "1";
-    if (op === "bundle" && strategy) p.strategy = strategy;
+    for (const k of spec.params) if (flags[`${op}.${k}`]) p[k] = "1";
     return p;
   };
 
@@ -294,7 +269,7 @@ function OpsBox({ repo, overview, onChanged }: { repo: string; overview: Overvie
     <Box title="Maintenance" id="ops">
       <div className="pad">
         <p className="small muted">
-          Every action runs on the instance that answers this request ({overview.hostname}) under the repo's GCS lease
+          Every action runs on the instance that answers this request ({overview.hostname}) under the repo's object-store lease
           where exclusivity matters, and publishes its result to the WAL like any other writer. Output streams below.
         </p>
         <table className="kv ops-table">
@@ -309,32 +284,16 @@ function OpsBox({ repo, overview, onChanged }: { repo: string; overview: Overvie
                 <td>
                   <div>{s.description}</div>
                   <div className="op-params">
-                    {s.params.flatMap((k) =>
-                      k === "strategy" ? [] : (
-                        <label key={k} className="small muted">
-                          <input
-                            type="checkbox"
-                            checked={!!flags[`${s.id}.${k}`]}
-                            onChange={(e) => setFlags({ ...flags, [`${s.id}.${k}`]: e.target.checked })}
-                          />{" "}
-                          {PARAM_HELP[k] ?? k}
-                        </label>
-                      ),
-                    )}
-                    {s.params.includes("strategy") && (
-                      <label className="small muted">
-                        strategy{" "}
-                        <select value={strategy} onChange={(e) => setStrategy(e.target.value)}>
-                          <option value="">default (first full)</option>
-                          <option value="due">due (per schedule)</option>
-                          {overview.ops.bundle_strategies.map((b) => (
-                            <option key={b} value={b}>
-                              {b}
-                            </option>
-                          ))}
-                        </select>
+                    {s.params.map((k) => (
+                      <label key={k} className="small muted">
+                        <input
+                          type="checkbox"
+                          checked={!!flags[`${s.id}.${k}`]}
+                          onChange={(e) => setFlags({ ...flags, [`${s.id}.${k}`]: e.target.checked })}
+                        />{" "}
+                        {PARAM_HELP[k] ?? k}
                       </label>
-                    )}
+                    ))}
                   </div>
                 </td>
               </tr>
diff --git a/web/src/pages/Repos.tsx b/web/src/pages/Repos.tsx
index 5bd70ed..55d516a 100644
--- a/web/src/pages/Repos.tsx
+++ b/web/src/pages/Repos.tsx
@@ -26,7 +26,7 @@ export function Repos() {
               </Link>
               <div className="muted small">
                 <code>
-                  git -c transfer.bundleURI=true clone {location.origin}/{owner}/{r}.git
+                  git clone {location.origin}/{owner}/{r}.git
                 </code>
               </div>
             </li>
diff --git a/web/src/pages/SettingsPage.tsx b/web/src/pages/SettingsPage.tsx
index cb1e9f1..cc69615 100644
--- a/web/src/pages/SettingsPage.tsx
+++ b/web/src/pages/SettingsPage.tsx
@@ -64,72 +64,11 @@ function Tasks({ d, o, full }: { d: SettingsDescribe; o: Overview; full: string
   const host = d.maintenance.this_host;
   return (
     <>
-      <Box title={`Bundle strategies (${d.strategies.length}) — ${d.bundles.enabled ? "enabled" : "disabled"}`}>
-        {d.strategies.length === 0 ? (
-          <div className="muted pad">No strategies in the effective config.</div>
-        ) : (
-          <div className="scroll-x">
-            <table className="grid">
-              <thead>
-                <tr>
-                  <th>name</th>
-                  <th>kind</th>
-                  <th>base</th>
-                  <th>schedule</th>
-                  <th>next (local time)</th>
-                  <th>keep</th>
-                  <th>backfill</th>
-                  <th>min commits</th>
-                  <th>refs</th>
-                </tr>
-              </thead>
-              <tbody>
-                {d.strategies.map((s) => (
-                  <tr key={s.name}>
-                    <td>
-                      <strong>{s.name}</strong>
-                    </td>
-                    <td>
-                      <span className={`pill ${s.kind}`}>{s.kind}</span>
-                    </td>
-                    <td>{s.base ?? "—"}</td>
-                    <td>
-                      <code>{s.schedule}</code>
-                      <div className="muted small">{s.schedule_human}</div>
-                    </td>
-                    <td>{fmtTime(s.next)}</td>
-                    <td>
-                      {s.kind === "full" ? (
-                        s.keep
-                      ) : s.chain ? (
-                        <span title="chained: each slot is cut on this strategy's previous bundle; every link since the newest kept base stays listed">
-                          chain since {s.base}
-                        </span>
-                      ) : (
-                        <span className="muted" title="cut on the base's newest bundle; the 2 newest are listed (D21)">2 newest</span>
-                      )}
-                    </td>
-                    <td>{s.backfill_max || "∞"}</td>
-                    <td>{s.kind === "full" ? <span className="muted">never gated</span> : s.min_commits}</td>
-                    <td className="small">{s.refs.join(", ")}</td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          </div>
-        )}
-        <div className="pad small muted">
-          Calendar slots, backfilled oldest-first; content = WAL state as of the slot; creationToken = slot epoch. Fulls are never gated by
-          min_commits; an incremental below the floor is <span className="pill too-small">too-small</span> and the next slot catches up.
-          Refs {d.bundles.main_only ? "main-only" : "all"} for this repository.
-        </div>
-      </Box>
-
       <Box title="Maintenance placement (host facts, read-only)">
         <KV
           rows={[
             ["checkpoints", d.maintenance.checkpoints ? `on · every ${d.maintenance.interval_secs}s pass` : "off"],
-            ["compaction", d.compaction.enabled ? `on · trigger ${d.compaction.trigger_packs} packs / ${fmtBytes(d.compaction.trigger_bytes)}` : "off"],
+            ["pack maintenance", d.packs.enabled ? `on · fold threshold ${d.packs.fold_when_fresh_packs_reach} packs · segment target ${fmtBytes(d.packs.segment_max_bytes)}` : "off"],
             [
               "this instance",
               <span key="this-instance">
@@ -139,13 +78,13 @@ function Tasks({ d, o, full }: { d: SettingsDescribe; o: Overview; full: string
             ],
             ["capacity here", `${host.disk} · pack cap ${fmtBytes(host.max_pack_bytes || host.cache_budget_bytes)} · cache budget ${fmtBytes(host.cache_budget_bytes)}`],
             ["upstream follow", <UpstreamFollow key="upstream-follow" u={d.upstream} />],
-            ["maintainers", <Maintainers key="maintainers" list={o.bundle_plan.maintainers} orphaned={o.bundle_plan.orphaned} label={false} />],
+            ["maintainers", <Maintainers key="maintainers" list={o.maintenance.maintainers} orphaned={o.maintenance.orphaned} label={false} />],
           ]}
         />
         <div className="pad small muted">
           Who maintains a repository is a host rule (<code>[placement] maintain / maintain_exclude</code> + declared capacity), not a repository
-          setting. What those hosts will cut next, and the chain they have published, is on the <Link to={`/${full}/wal`}>WAL page</Link>; change
-          strategies, min_commits or compaction triggers for <code>{full}</code> under “Effective config & history”.
+          setting. Their recent maintenance work is on the <Link to={`/${full}/wal`}>WAL page</Link>; change
+          checkpoint settings or pack maintenance for <code>{full}</code> under “Effective config & history”.
         </div>
       </Box>
     </>
@@ -412,7 +351,7 @@ function EffectiveConfig({ d, full }: { d: SettingsDescribe; full: string }) {
             spellCheck={false}
             rows={Math.min(24, Math.max(8, text.split("\n").length + 1))}
             value={text}
-            placeholder={"# TOML overrides of [bundles], [maintenance], [compaction], [upstream]\n[bundles]\nmin_commits = 25\n"}
+            placeholder={"# TOML overrides of [refs], [packfile_uri], [maintenance], [packs], [upstream]\n[packs]\nfold_when_fresh_packs_reach = 25\n"}
             onChange={(e) => {
               setText(e.target.value);
               setDirty(true);
diff --git a/web/src/styles.css b/web/src/styles.css
index 3f58076..af952c7 100644
--- a/web/src/styles.css
+++ b/web/src/styles.css
@@ -818,12 +818,10 @@ details summary { cursor: pointer; margin-top: 8px; }
 .api-table td:first-child code { font-size: 12px; }
 .api-notes { margin: 0; padding: 12px 16px 12px 32px; font-size: 13px; display: flex; flex-direction: column; gap: 8px; }
 
-/* ---- bundle plan ---- */
+/* ---- maintenance state ---- */
 .pill.missing { background: #7a4a00; color: #fff; }
 .pill.built { background: #1f6f3a; color: #fff; }
-.pill.unavailable, .pill.blocked, .pill.too-small, .pill.wrong-host { background: var(--bg3); color: var(--fg2); }
 .pill.stale { background: var(--danger, #c33); color: #fff; }
-tr.warn td { background: rgba(255, 180, 0, 0.06); }
 
 /* Instance footer: which machine answered, by name. */
 .instance-footer { position: fixed; right: 10px; bottom: 8px; display: flex; gap: 8px; align-items: center;
@@ -848,8 +846,6 @@ tr.warn td { background: rgba(255, 180, 0, 0.06); }
 .btn.primary { background: #1f6f3a; color: #fff; border-color: #1f6f3a; }
 .btn.danger { border-color: #c33; color: #f85149; }
 .grid tr.setting-row td { background: rgba(63, 185, 80, 0.07); }
-.pill.full { background: #1f4f8a; color: #fff; }
-.pill.incremental { background: var(--bg3); color: var(--fg2); }
 .kv { display: grid; grid-template-columns: max-content 1fr; gap: 4px 16px; margin: 0; padding: 8px 16px; font-size: 13px; }
 .kv > div { display: contents; }
 .kv dt { color: var(--muted); }
@@ -895,17 +891,6 @@ input.text.small { font-size: 12px; padding: 2px 6px; margin-left: 8px; font-wei
 .trailers-table .trailer-value {
   word-break: break-all;
 }
-/* Bundle slots / chain (WAL page) */
-.pill.pending { background: #3b4a7a; color: #fff; }
-.pill.skipped { background: var(--bg3); color: var(--fg2); }
+/* WAL page */
 .btn.link { background: none; border: 0; color: var(--link, #0969da); cursor: pointer; padding: 0 4px; }
-table.kv.compact th { font-weight: 500; padding: 2px 8px 2px 0; white-space: nowrap; }
-table.kv.compact td { padding: 2px 0; }
 .maintainers .pill { margin: 0 4px 4px 0; }
-.chain { font-size: 0.95em; }
-.chain-node { position: relative; }
-.chain-row { display: flex; flex-wrap: wrap; align-items: baseline; gap: 4px; padding: 3px 0; }
-.chain-root { border-top: 1px solid var(--border); margin-top: 4px; padding-top: 6px; }
-.chain-node:first-child .chain-root { border-top: 0; margin-top: 0; }
-.chain-edge { color: var(--fg2); font-family: monospace; width: 1.6em; display: inline-block; }
-.warn { color: #7a4a00; }
diff --git a/web/vite.config.ts b/web/vite.config.ts
index 71b3a4e..9ca2f35 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -18,7 +18,7 @@ export default defineConfig(({ command }) => ({
       "/api-browser/": process.env.WALGIT_URL ?? "http://127.0.0.1:8080",
       "/services/api/": process.env.WALGIT_URL ?? "http://127.0.0.1:8080",
       "^/[^/]+/[^/]+/api(-browser)?(/|$)": process.env.WALGIT_URL ?? "http://127.0.0.1:8080",
-      "^/[^/]+/[^/]+(\\.git)?/(info/refs|git-upload-pack|git-receive-pack|bundles/)": process.env.WALGIT_URL ?? "http://127.0.0.1:8080",
+      "^/[^/]+/[^/]+(\\.git)?/(info/refs|git-upload-pack|git-receive-pack)": process.env.WALGIT_URL ?? "http://127.0.0.1:8080",
     },
   },
   build: {