[pi-durable]

Refs #303.

Narrow scope

Reuse structural journal metadata only for unchanged repeated restores in the same loaded module, under Pi's native append-only contract. The bounded four-path cache does not retain browser bodies, selected branches or restored state.

A changed device/inode, size, or observable modification/change time forces a complete validation scan. Appends change length and therefore always rescan; they never certify an unchanged prefix. Truncation and replacement/rewrites invalidate when their fingerprint changes. Identity, branch/event/winning-definition validation, final descriptor/path checks and the original rewrite-plus-growth invariant remain.

Matching stat fields are not an immutability proof. A same-length behind-host edit of an old entry can leave all five fields equal and reuse stale metadata. That mechanism is real, not ruled out by nanosecond-valued fields. It is outside the existing native append-only contract; see the scope/severity discussion. No universal mutation-detection guarantee or new runtime guard is proposed.

Result and limits

Five matched alternating synthetic cloud/source pairs through official Pi 1.4.0 SDK navigation measured median 1103.934 → 11.446ms. This is not installed-macOS latency evidence. Cold binding medians 1417.547/1374.172ms have overlapping ranges: no cold-start improvement is established. New-process startup, session-switch/fork and append-invalidated work remain in open issue #303. Published Pi/browser turns append entries.

Immutable samples, commands, inputs and profiles.
The original official 1.4.0 macOS model/TUI archive covers precommit source 888fa282 and public-site native-tool behavior only—not cache hits, tree navigation or fork-model behavior. Test/docs follow-ups are not model-executed trees; runtime/build/lock/SDK identity must remain unchanged for that receipt to apply.

Qualification

The local follow-up corrects documentation and two implementation-coupled cold/eviction read thresholds, retaining warm<4096 and every ctime/identity/ancestry/race assertion. Production runtime, build and lock bytes remain unchanged. Canonical product documentation is being consolidated into docs/PERFORMANCE.md and session storage; immutable JSON/archive bytes are preserved.

Safe local follow-up lint/format/compiler/build/generated-docs/help gates and 7/7 cache tests pass. One unfiltered run of three fresh safe import/factory samples measured 255.969/319.990/327.308ms, all above the unchanged 250ms budget: FAIL, with no retries or waiver. These are locked-development-SDK 1.0.2 diagnostics, not latest-host qualification. No further push or broader gates before parent source/design review; the fresh startup failure remains unwaived.

Published head 5f3c61f currently has 24 successful and 6 skipped checks, all 30 terminal—not 30 passed. Those checks do not qualify an unpushed follow-up. Earlier local Linux startup failures on main and candidate remain failures. Fresh exact-head relevant gates and complete feedback remain required after parent review. No universal disposable-fixture archiving framework is a delivery prerequisite.

Source-only. Leave OPEN/non-draft, auto-merge off. No merge, installation, activation or restart; parent final acceptance remains outstanding.

[pi-durable]

Evidence-provenance clarification: the earlier independent same-model reviewer did not hash its imported build graph before its simulations. Those simulations are not counted as hash-matched runtime qualification. The separate red/green filesystem regression and frozen source/build receipts provide that proof; this was not a model-diverse panel.

The evidence record also keeps the actual-model smoke’s historical executed tree distinct from later test/evidence-only changes. All four runtime/build/lock hashes still match after the current-head rebuild.

The pre-PR exact-head workflows passed. PR-triggered CI, Pi Durable Review and Cursor review are now running; Babysit remains in drive. This PR will stay open, and I will not enable auto-merge or merge it.

[cursor]

A same-size in-place rewrite that does not advance the coarse inode timestamp reuses the cached structural index. Branch restore can then keep the previous ancestor’s page.

  

_{Sent by Cursor Automation: PR Bug Review - Maintained Repos}

[fitchmultz]

Main now includes #307 as 0e654eb77ebd3a73dbcd216ff108431c60756e37. It changes the npm-root development graph from Undici 8.10.2 to exact 8.12.3, without changing extension runtime dependencies or the Pi support floor. Git-source development builds receive the root override; published npm consumers do not, and official Pi hosts retain their own dependency graph.

Any subsequent integration of this PR needs the updated main/development lock and applicable final-tree gates. This note is only about the changed dependency baseline; it is not acceptance of the index/cache correctness, and does not declare #303 delivered.

AI-generated by github-backlog-coordinator.

[fitchmultz]

PR #306 merged as a955047aa7f60a99cc67247609de7dcb32e2b607 (tree d0bf32a9016b7f1d1f3cda7a872593a797527373). It includes #307 and the memory-bounded native parse / first-error-order remediation. Its exact PR-head checks and reviews passed; exact merged-head quality, compatibility and lifecycle are running separately.

This is a safe partial full-journal reader improvement, not an approved incremental index. #303 remains open (reopened after GitHub auto-closed it on merge). No approval of #304's cache or of a narrowed file-validation/publication contract is implied. This update does not involve reading #304's held source.

Any continuation of #304 must integrate current main normally and retain the native persistence, malformed-input, memory, branch and failed-finish non-revival contracts. The proposed metadata/header/last-record cache still needs a sound public signal or an explicit owner semantics decision; do not treat #306's future-design outline as that decision. Configured installation and fresh installed-consumer verification of the merged partial work remain in progress.

[fitchmultz]

#308 merged as 8f4207cd8792793f16ee08a9a4a4764a887f083b. Main now reuses native journal structure per live SessionManager/header generation and parses complete appended records incrementally. Selected result/ref data is still reread and verified; generation, publication and stale-ref guards remain intact.

This overlaps the replay-index work here. Any continuation should reconcile those changes with current main rather than duplicate the cache. The maintained quality gate, exact-head reviews and Linux native lifecycle passed. This is a main-branch impact update, not a review of this branch.

[fitchmultz]

Closing as superseded: #308 (perf(browser): replay only appended session metadata) landed on main and closes #303, with a per-manager identity-validating structural index (append-suffix parsing, reseed detection, conservative fallbacks) that supersedes this PR's module-level stat-fingerprint cache. This PR's measured evidence (docs/performance/issue-303.*) remains available in the branch history.