JS-077: orphan keeper pack on a lost ref CAS (permanent disk leak)

Now: OPEN
Sev: MED

POST writes the keeper pack-log + idx as the FIRST store mutation (post.js:242-243), THEN advances the ref with an expected-old CAS (post.js:246 → advanceRef, post.js:112-118). When the CAS loses — a concurrent advance, exactly the race the CAS defends — advanceRef throws POSTNOFF (post.js:114-116) AFTER the pack is on disk. There is no rollback and no GC path anywhere, so each lost-CAS post leaves the just-written pack-log + idx orphaned: a permanent per-incident disk leak. Content is content-addressed, so it is a leak, not corruption. Method: Issues.

Input

Context

post.js:242-243: commitM.writePack(reader.shard, info.wt, …) — "the FIRST store mutation" (the comment :240 says so).
post.js:246: advanceRef(reader, reader.shard, branchKey, expectedOld, commit.sha) runs AFTER the pack write.
post.js:112-118 advanceRef: if ((cur||"") !== (expectedOld||"")) throw "POSTNOFF: REFS … advanced concurrently — retry" — the lost CAS.
No catch around :246 and no later GC of unreferenced pack-logs/idx — the NNNNNNNNNN.keeper(+.idx) just written stays on disk forever.

Goals

A lost-CAS post leaves NO orphan pack-log/idx on disk (either the pack is written only after the ref slot is reserved, or it is unlinked on the POSTNOFF path).

Constraints

Preserve the CAS semantics (POSTNOFF on a concurrent advance) and the POST-017 all-or-nothing intent.
libabc+libdog ONLY; keep writePack byte-output unchanged.
Scope to post.js's write/advance ordering; do not weaken the CAS.

WIP

Design decisions

Option A: do the CAS/reserve BEFORE writePack (re-check expected-old, then write, then commit the ref).
Option B: wrap advanceRef in a catch that unlinks the freshly written pack-log + idx before re-throwing POSTNOFF (record their paths from writePack).

TODOs

Repro-first test/js/post/*: force a lost CAS (mutate the ref between pre-flight and advanceRef) and assert NO orphan pack-log/idx remains.
Implement the chosen ordering/rollback; keep POSTNOFF behavior.
Re-run the post parity suite (clean-FF posts byte-equal, unaffected).

Blockers and bummers

writePack must surface the exact file names it created so a catch can unlink precisely (avoid clobbering a concurrent winner's pack).
2026-07-07 audit: STILL OPEN (line refs shifted) — verbs/post/post.js:685 commitM.writePack(reader.shard,…) runs BEFORE :692 advanceRef(…); no catch/unlink, no GC. A lost CAS (advanceRef:222-225 POSTNOFF) leaves the pack-log+idx orphaned.
2026-07-10 revision: still OPEN — post.js:688 commitM.writePack runs BEFORE :695 advanceRef; advanceRef:225-228 throws POSTNOFF on lost CAS; no catch/unlink around :695, no GC -> orphan pack-log+idx

Outcome

(pending)