[forhappy]

The add/commit/push smoke stops at its first immutable-data fault because it searches for standalone .pack and .idx keys. The current stack stores both inside a capsule run. Exercise that real storage boundary: delete the complete capsule, corrupt only its Git pack range, and corrupt only its Git index range.

Stacked on #588. Draft while the complete CLI rerun and broader initiative gates remain pending. No product Rust code, dependency, or inventory baseline changes.

Behavior and invariants

• Locate the synthetic single-member run's exact absolute pack/index ranges from its current-format footer. Reject malformed ranges, format mismatches and out-of-container targets before mutation. The qualification helper locates fault bytes; production readers still authenticate all data they consume.
• Confirm a real DELETE with a subsequent 404. For each corruption, use a conditional PUT and reread the exact one-byte-damaged body; preserve every other byte, including the footer.
• Start each rejected clone from an empty cache and require failure before local HEAD publication or checked-out payload. Corrupted members must surface an integrity error.
• Verify a healthy exact remote tip before the fault, then compare canonical root/ref-head bytes before/after. A damaged capsule can also make discovery fail, so a successful post-fault ls-remote is not a valid mutation observation. The remote-authority preservation invariant remains explicit.
• Remove the obsolete suffix-based fixture implementations; keep one current-format fault path. Non-test harness code shrinks by 24 lines.

Validation

• Original full-smoke failure retained: 191 commands / 84 checks, failure at .pack fixture discovery, before any mutation.
• Initial new fault replay retained: missing-capsule and corrupt-pack rejection checks passed; post-corruption ls-remote also returned CRAB-E0020, exposing the obsolete observation method.
• Corrected real RustFS replay: 42 commands / 49 checks passed, including all three fault cases and exact authority comparisons. Report SHA-256 89bdbfbc67c7042d5bd866dfa9c6615b213bfe8fb80195885e4a2108defa7b8a.
• Python source/fixture tests: 14 passed, including absolute range selection and malformed/truncated/out-of-bounds fixture rejection.
• Rust format and diff checks: passed.
• Uses the already-built 433bba8e553 CLI; its SHA-256 remains 1571029a817d09c53ae32e3c899651886c9b2545eb0b33675fd5ce339f7d4010. This follow-up changes only the harness, its tests and documentation.
• The complete ordinary-Git plus native/Git managed-file smoke is red after 308 commands / 143 checks: it passed the revised fault cases and later failed cross-repository-remote-duplicate-add-records-proof-bearing-remote-authority. The consumer staged one local prepared payload (59 chunks) and zero remote-authority chunks. Source/contract diagnosis is required; that assertion is unchanged. Do not treat the focused replay as a full-suite or 10 GiB result.

Review evidence

Boundary	Evidence
Entry / owner	AddCommitPushSmoke.run -> run_capsule_failure_case; qualification-only behavior
Current-format contract	crab-metadata CapsuleRun footer v4 and PackMemberDescriptor/PackRange; actual published fixture contains pack bytes at 315..713 and index bytes at 713..1897
Callees	Signed S3 GET/conditional PUT/DELETE, real Git clone and local HEAD verification
Siblings	Missing/corrupt root checks retain their existing behavior; shallow/native/Git workflow cases still execute; all physical faults share cold-cache and authority invariants
Current main	Its smoke targets standalone .pack/.idx; this stack has switched physical publication to capsule runs
Tests	Real RustFS faults plus range-selector and source-isolation unit tests

Is this the best fix? Target the format the publisher actually emits and observe unchanged authority independently of unavailable data. Restoring standalone artifacts or adding a legacy suffix fallback would create a second storage path solely for the fixture.

Captured-reader GC retention, the parent SQLite source-policy mismatch, final integrated 10 GiB pattern/order/failure qualification, full blame semantics, and representative S3 latency/scaling evidence remain unresolved initiative gates. No broader completion claim.

Cross-repository failure isolated

The same unchanged authority assertion fails in a fresh-bucket, case-only RustFS replay: 27 commands / 17 checks, with 72 prepared local chunks and zero recipe remote chunks. A new local, cache-free regression exercises real streaming staging, native Git commit, capsule push, and a different repository’s classifier. Source publication succeeds; classification returns [None]. Test runtime 0.80 seconds after compilation. The regression is retained locally, not pushed as a knowingly failing test.

This is a missing publisher/reader integration: capsule publication writes the per-repository pointer catalog but does not publish the shared committed-chunk index queried by add. That index’s existing source validator requires a released manifest/shard-list anchor. Negative-cache invalidation alone is insufficient. Released v1.2.4 contains the receipt contract and does not contain capsule push.

The correction must carry the verified canonical object’s ETag/version and both digest identities across publication: catalog body_digest covers the whole encoded xorb; OriginReceipt.payload_digest covers its payload. create_or_read_immutable currently discards the write/read object identity. A later HEAD cannot retrospectively bind verification to that object version. No preliminary codec or unverified origin-proof shortcut has been wired into production. The complete smoke remains red.