fix: remaining adversarial-review findings (M4/M5/M6/M7, S2/S3, A4, F2, P2, AU6/AU7, R8, U6)

[russellromney]

Works through the remaining tractable findings from ADVERSARIAL_REVIEW_2026-06-25.md, after #62–#65 merged. Audited each against current main first (the report's line refs were two main-versions stale); all below were still open. Themed commits; full cargo test + clippy -D warnings + fmt green on macOS, with the Linux-only io_uring changes typechecked + clippy'd in a rust:1.96.0 container. Regression tests for the key fixes.

Fixed

• M4 — order "newer never loses" by the commit's history depth (generation, from git rev-list --count) instead of the builder's wall clock, so cross-host clock skew can't reorder. Falls back to synced_at for refs without it. (Known, documented limit: a force-push rewind to an older commit lags until the next forward push.) (tests)
• M5 — read cache served a ref that lost the durable ordering check for the TTL window; invalidate on save. (test)
• P2 — HashingWriter re-hashed the remainder on a short write → bad pack trailer for >256 KiB-compressing blobs. (test)
• S2 [High] — local retention could delete the only copy of a still-referenced artifact; now protects the ref-reachable set each run (walk shared with remote GC). (test)
• A4 — a push during an in-flight (claimed) build was coalesced and dropped; coalesce only onto queued jobs, allow a queued job behind a claimed one. (test)
• M6 — MySQL VARCHAR keys silently truncated/collided; reject over-long keys.
• M7 — networked queue + per-host file metadata silently lost refs; warn loudly at startup (not refuse — single-host shared-filesystem farm-out is valid).
• S3 — GC continued past a manifest read error (could delete live objects); fail the pass closed.
• F2 — unbounded no-dictionary decompress; cap at the frame's raw length.
• U6 — racy exists()-then-create_dir; use the atomic form.
• AU6 — artifact redirect ignored private TTL; use the visibility-aware TTL.
• R8 — HTTP client builder silently dropped auth headers on build error; fail fast.
• AU7 — token file briefly world-readable + swallowed chmod error; create 0o600 up front, surface errors.
• U3 — opt-in fsync durability barrier (RIPCLONE_FSYNC=1): flush the staged tree, publish, then flush the parent dir so a crash can't leave a torn tree git calls clean. Off by default. (test)
• U4 — io_uring write_regular_batch_deferred submitted one window for the whole batch (slot-range overrun past MAX_BATCH_FILES); chunk into windows like the synchronous path. (Linux)
• U5 — io_uring normal-fd fallback could double-close an fd the kernel already closed (and another thread reused); drop fd handles right after a successful submit, keep the sync close only on submit failure. (Linux)
• U7 — removed dead write_entry (the archive clone uses the owned-write scheduler) and its now-unused imports.
• AU8 — credential header name was hardcoded to Authorization; add an optional auth_header_name (config + CLI flag), validated as an HTTP field token so a bad config can't smuggle a second header. (tests)

Deferred (with reasons)

• P6 (empty-repo clone) — larger than the bullet implies: an empty repo fails at server resolve (404) and build ("no objects to pack") before the client's index_pack is even reached. Real support touches the central resolve/build path. Documented as a roadmap limitation instead of half-fixing one symptom.
• S4 (download range/resume), P4 (sha256 object format) — features.
• R4 + R5–R12 (perf) — want before/after benchmarks (like perf(client/extract): cut hot-path copies + a per-file lock (R1/R2/R3) #65).
• P3 (head-delta cold-base fallback), P5 (LSM ancestry) — deep build-path logic whose force-push/GC failure scenarios can't be reproduced here to verify.
• The report's "areas needing deeper review" — investigations.

🤖 Generated with Claude Code