Write a point-in-time Cyd Bluesky archive v2 export

[micahflee]

Closes #98.

Mobile could not turn Bluesky saved data into a Cyd Bluesky archive at all, so
every reader issue had only synthetic fixtures to work against. This builds the
version 2 writer and uses it to produce the first real-data fixtures.

How an export works

Four steps, and the order is the design:

1. Stage — pause account-mutating work, VACUUM INTO a copy of the account
   database, stat every preserved file. This is the moment the archive
   describes (ADR 0010). The pause covers only this, never hashing or packaging.
2. Hash — with saving running again, read every inventoried file. Anything
   that disagrees with the inventory becomes an honest asset state rather than a
   silent omission: gone is unavailable, never downloaded is missing, and
   either one makes the archive incomplete.
3. Translate — Mobile's private rows into the Bluesky interchange model
   (ADR 0002), in a pure function over rows and asset results.
4. Package — stream media, data.db, metadata, and manifest into the ZIP.

Nothing reads the live account after step 1, so however long the rest takes, the
archive stays internally consistent.

Decisions worth a look

• Translation invents nothing. Mobile does not store when a like was
  created, a bookmark's own record URI, or a reply parent it never saved. Those
  become observation times, selections naming the post, and context carrying
  only the author DID the AT URI already names. The full gap list is in
  docs/bluesky-archive-fixtures.md and reprinted by the readiness script.
• Media is stored, data.db is deflated. JPEG and MP4 do not compress, and
  a streaming deflate cannot know its size before it finishes — on a phone that
  would mean buffering a whole video. The database is compressed into a second
  staged file first, so its empty SQLite pages cost 4 KiB instead of 144 KiB.
• The pinned schema.sql is embedded verbatim, because a phone cannot fetch
  the contract mid-export. npm run test:archive-contract compares the copy
  against the pinned bundle character-for-character so it cannot quietly fork.
• Export is behind __DEV__ until Pass bidirectional Cyd Bluesky archive v2 conformance and enable the writer #100 proves conformance both ways
  (ADR 0004), with a test that fails if the affordance ever renders in a
  release build.

Fixtures

testUtils/fixtures/bluesky-archive/{complete,incomplete}.cyd, produced by this
writer from a curated test account (ADR 0016). The pair differs by exactly one
asset — the largest image, failed for one export — and by the completeness that
follows. fixtures.test.ts enforces that, plus the 5 MiB budget and the set
of handles in profiles; a budget in prose does not survive a regeneration.
Provenance and regeneration steps are in the fixtures README.

Three caveats

• Not every deletion state survives. A bookmark removed at source, and a
  like removed at source whose URI Cyd never saw, have no record in the
  interchange model to carry that state. Documented rather than silently lost.
• The fixture account was curated on a pulled copy, not on the device. The
  account held 45 MiB of video across two posts, one of them a stranger's; that
  and every post written by somebody else were removed from the copy before
  export. This curates the export's input rather than trimming the archive, so
  it honours ADR 0016's reasoning, but not its letter.
• That curation removed third-party records, not third-party content nested
  inside the account's own. Both fixtures keep one quote post of the
  account's whose payload_json carries the hydrated view it quoted:
  bsky.app's post, and nested within that a second post by
  barmas.bsky.social — display names, avatar URLs, engagement counts, a
  mention of @brimcrob.bsky.social, and reply URIs naming a fourth DID. It is
  all public Bluesky content and it stays, because removing it would mean
  removing the quote. Note that fixtures.test.ts reads profiles.handle
  only, so it does not check payloads for this.

The fixtures therefore cover posts, reposts, likes, chats, and images, but not
video, replies, link previews, or bookmarks. The canonical bundle still covers
those, and it remains the semantic oracle either way (ADR 0008).

Verification

• npm test (785), npm run lint, npm run test:archive-contract,
  npm run test:archive-conformance, check_latest.py — all pass.
• conformance.py accepts archives this writer produces, checked against the
  pinned contract rather than against Mobile's own idea of the format.
• Mobile's own intake takes its own output back in, including the deflated
  database.

Not in scope

Resumability, staging cleanup, the plaintext warning, and the shippable export
flow are #99. Enabling export for people is #100.

(This was written by an LLM.)

🤖 Generated with Claude Code