[forhappy]

A healthy current catalog does not prove that cold browse captures retain valid index pages and original Git sources. Full fsck must authenticate those dependencies, and it must keep their lifetime/readiness identity through payload verification and the final snapshot check. The new regression changes a browse head during a real xorb GET and observes a false clean Ok([]) on the previous combined implementation.

Authenticate the retained browse chain and completely verify its graph, path-state, physical-index pages and original source bodies. Verify each shared source once during that phase, including superseded ref-only runs. Return an opaque verified control capture and retain it lazily in the checker. Later checks revalidate only the bounded lifetime/readiness records: valid movement requests a retry; invalid records fail validation. Mirror pointer-recipe probes do not initialize the full browse-maintenance proof.

Stacked on #599, which supplies the corresponding original-source lifetime capture on #597. This replaces the earlier #594 branch based on #591. The add-cache performance change in #592 stays separate. No serialized formats, dependencies, configuration or lockfiles change. The user-owned advisor plan and both large-file audit reports are excluded.

Validation on exact PR head 70a9a78:

• 25 reader-feature metadata retention tests, 22 publication tests and 96 CLI fsck/GC/history/candidate-cache tests pass. A separate storage-only slice passes 21 tests.
• Strict release all-target Clippy passes for crab-metadata, crab-storage and crab-write. Format and whitespace checks pass. All 2,636 guarded tracked inputs match committed Git blobs; the fetched origin/main cc2e4e2 is already an ancestor.
• The corruption-during-xorb regression fails before the capture fix and passes afterward for both lifetime and readiness controls. A final-phase regression rejects valid control movement after payload verification. The mirror sibling test verifies an actual pointer recipe without requiring browse maintenance.
• The new mirror proof exposed a fixture that used Xet's keyed chunk hash as its ordinary whole-file Blake3 identity. The fixture now uses the actual file digest; the production verifier and positive byte-verification assertion remain intact. The failed run is preserved.
• The complete local combination with Avoid per-chunk cache writes for absent indexes #592 also passes 25 metadata, 22 publication and 97 CLI tests plus the storage-only and strict-Clippy slices.

The parent source-retention fix now has a separately audited real RustFS result: 532 publications, a source aged beyond the explicit one-hour GC cutoff, cold pinned catalog answers after GC, independent 64 MiB reconstruction, and missing-source detection/exact restoration. That qualifies #597 only. It is not live proof of this PR or of the final combined 10 GiB workload.

Remaining gates: combined 10 GiB pattern/order/compaction coverage, concurrent pruning/publication, rollout/backfill and representative S3 latency remain required. The entropy/native-first 10 GiB case with cold capture, 532 publications and real one-hour-grace GC has started; no result is claimed yet. The prior isolated immediate-restore failure remains unexplained. The parent stack also has a stale rusqlite policy expectation awaiting the explicit approval required by AGENTS.md. No expected-policy record or lint gate is disabled here. This draft is not ready to merge.

Evidence map:

• Entry: main.rs capsule fsck dispatch -> cmd/fsck.rs::run_fsck -> StoreChecker data/final checks.
• Owner: crab-metadata authenticates retained records and exposes their opaque control capture; the CLI owns the operation lifetime and retry decision.
• Callees: complete graph/path-state loaders, PagedGitObjectIndex::verify_retained, bounded source hash verification, and bounded control GETs preserving the provider ETag/version pair.
• Siblings: mirror pre-push/reconcile call verify_capsule_pointer_data and never initialize browse maintenance; GC and publishers keep their existing retention/fence paths; fix(fsck): pin source lifetime through verification #599 separately retains original-source authority.
• Tests: missing/corrupt superseded dependencies, graph/physical/state bindings, real xorb-triggered corruption, final-phase movement and actual mirror recipe verification.
• Current main lacks this complete capsule fsck path. The previous stack's deterministic false clean is preserved as the before-change evidence.

Is this the best fix? Keeping the verified capture at the existing checker boundary covers later phases without adding writer locks, reader leases, a second lookup path, repeated immutable-body scans or mirror workload. The production growth supplies complete retained-dependency verification and a small cross-phase proof; most of the diff is regression coverage.

Combined native qualification (909a40a2559):

• The official installer and publication-feature qualifier build/strict Clippy completed. All five installed binary hashes and 2,637 guarded source inputs match the frozen clean checkout.
• Real native fsck passed 12 commands / 32 checks against the task-owned 64 MiB/532-publication RustFS fixture. During an actual xorb response, separately corrupting either browse lifetime or readiness caused native fsck to exit 1 with invalid browse-index JSON and a failed terminal result.
• An independent wire audit confirms each successful payload GET precedes the later corrupt control GET, with no proxy errors. Restoring each control to its original absence makes native fsck pass; the root bytes remain unchanged. Three healthy native fsck runs report zero errors.
• This is combined-source 64 MiB control-fault qualification, including Avoid per-chunk cache writes for absent indexes #592. It does not prove nonempty retained browse-body coverage, the final 10 GiB matrix, hosted-S3 latency or the full initiative.