The keeper owns the flat per-project object pool (git blobs/trees/commits; branches/tags/remotes are refs into it). Tickets here cover the object store, tree/commit walks, refs, and the wire pack paths. Plan-shaped, cleared via the Issues loop.
NNNNN.keeper log has no upper bound, so GET-044 landed a durable 6.0 GB log no reader can open (io.mmap truncated silently past 2^31, JSC aborted past 4 GiB). RULING: cap at 2 GB (2^31-1, the only bound that survives the whole path); log splitting is fine, indexes already take multiple files. Crossing deltas re-anchor as REF — measured +0.38% of pack on linux.git vs +2.56% for all-REF, and all-REF would also turn 46M chain hops into 46M index lookups and cost the logs their standalone resolvability. Mapper-side guard already in jab/io.cpp (JABC_MAP_MAX).keeper post self-deadlocks: holds the per-shard <store>/<shard>/.lock WRITE flock, then its forked keeper receive-pack blocks acquiring that SAME flock while the parent waits on the child's pipe — permanent deadlock that wedges the shard (hit on libabc, blocked a beagle clone). Fix: avoid the double-acquire.8f7233c3 — torn .keeper.idx (concurrent posters sharing a pid-less temp) served as KEEPNONE for in-pack objects; fix = per-pid temp index names + keep_rebuild_torn_idx rebuilds a short index from the pack on rw-open (which also auto-recovered the live store). Hermetic repro sniff/test/keep002-torn-idx.sh, 282/282.0eb0afab — converged FOUR near-duplicate tree-walkers (WALK.c, KEEP.c dead chain, WIRECLI.c, CLOSE.c) into one visitor-driven KEEPWalkTree (WALK.h:66); shape B (bounded recursion + hard WALK_MAX_DEPTH cap + right-sized carve, so it also delivers the unlanded MEM-023/024 safety goal), have/close-set dedup as a WALKSKIP visitor return; dead keep_walk_tree/KEEPPush chain deleted. New CLOSEtest, 396/396.