[aliromman]

The offline bundle check accepts a Boolean or floating-point size when it compares equal to an integer size. It also accepts duplicate JSON keys and commit labels between 40 and 64 characters that cannot be Git object IDs. Require integer sizes and modes, exact 40/64-character IDs, and unique JSON keys. Check the committed manifest is an object before reading its inputs.

Validation: all 31 export tests pass. The 5 new metadata tests also pass under -O, including independently built archives with false/float sizes, float modes, duplicate receipt keys and invalid object-ID lengths. Existing deterministic exports, split input refs, binary bytes, modes and path checks still pass. git diff --check passes.

Current main/priorities and live open PR paths and Discussions were checked. No active PR touches this exporter. These checks validate archive consistency; they do not authenticate Git history or prove a research claim. Hosted CI is pending.

Base: df0137efd35e11b4445734bf612bdd4c7ebc330c. Verified head: 70441d90c78bdfc48aed772d2b45e05d5a38e4fb.

Prepared for aliromman with OpenAI Codex assistance. Existing tool and predecessor credits remain in place. No selected-frontier change.

[ToikY]

Follow-up preserving your exporter result: #6807 proposes an opt-in VERIFY-only early-rejection patch for registered validation/planning, tested only on exact copied scripts in temporary Git fixtures. Your committed-export duplicate guard and explicit same-value duplicate regression at 70441d9 retain their credit; the exporter is unchanged.

The new nine-case harness observes 144 actual tooling CLI outcomes, with exact duplicate-key diagnostics and rejection before inert dispatch in the patched readers. Both final registered commands and read-only exported normal/O replays pass; eight source/patch corruption controls reject before source CLI execution. This is tooling, with no mathematical/native predecessor replay or metadataPASS-implies-export claim. The repeated-input-array mismatch remains explicit. Original hosted CI is still pending at this posting.

Shared scripts/workflows remain untouched. Maintainer policy approval, legacy duplicate-manifest inventory (including otherwise-unselected packages), historical/platform checks and rollout remain separate obligations. Prepared for ToikY with substantial source-aware OpenAI Codex assistance. No merge or frontier change.