[petalas]

Summary

The complete repaired pinned-edit scanner rereads every pinner at head, including files whose bytes its immutable-tree diff already proves unchanged. This opt-in package reuses those base bytes. On the fixed canonical replay it eliminates 123 head blob requests and 5,882,040 payload bytes, preserving the complete 154-row report and exit behavior.

Claim type: scoped implementation-preservation proof with exact finite comparison and observed work counts. Timing is inconclusive; no runtime speedup or new kappa is claimed. This contribution was produced by Nick Petalas.

- read head bytes for every merge-base pinner
+ read head bytes for changed pinners
+ reuse base bytes for unchanged pinners

The proof uses the original --no-renames tree diff: a merge-base pinner absent from its modified/deleted/type-changed set has the same bytes at head. The scanner's search, classification, target multiplicities, ordering and default/strict policy are unchanged. The new implementation is frozen at this first verified reduction.

Credit Armin Pourshafeie / apoursh, #6319, for the original scanner; ToikY, #6357, for the exact source-read repairs used here; and their retained source/integrity lineage. Their source-read correctness is a cited dependency, not this contribution's audit deliverable. The exact PR6357 scanner at 170867c0a8f92375dfc489dd090bad5daee7b090 is exported with its original notices and SHA256, so no unmerged Git object is needed for replay.

Evidence

• Before: the canonical comparison de5ec2e7a6074068452f45b1a191b5c72832df4a to 7c49fe32c55de02c2c873655c804b16e4c3fef0a requests 124 head pinner blobs, returning 19,620,947 payload bytes.
  After: it requests one changed pinner, returning 13,738,907 payload bytes. All 154 complete pin rows agree, including 153 advisory stale rows, one repinned row and zero frozen stale rows. Both base-loading phases are unchanged. These are returned payload bytes, not filesystem I/O or memory measurements.
• A separate synthetic Git history checks twelve expected rows, all three classification states, duplicate target digests, changed/unchanged/removed/added pinners, LF/CR filenames, CLI stdout and exits, the empty diff and three rejected adapter modes. Normal and optimized checks remain active without Python assertions.
• Ten fresh complete commands, five alternating pairs, all returned identical stdout without errors. Original median 21.064 s, range 20.770 to 21.347; reuse median 21.403 s, range 20.532 to 21.536. The ranges overlap. The separate profiled run spent only 0.189 of 19.944 s in all blob-loading calls, limiting possible runtime gains here. The generated BENCHMARK.json records every run and binds its source/output hashes.
• Local CPython 3.12.15 checks pass: direct normal in 41.27 s, direct optimized in 41.93 s, registered replay of both in 85.21 s. Metadata/pins pass. Committed-byte/source-history preflight passes for all eleven declared files at 40591325403a9897ca95f642345742d17b1bd2a0. Each registered command is below five minutes locally.

From the worktree root, with full Git history and the standard library:

/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/research_package.py --package research/pinned-edit-read-reuse
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -W error -B research/pinned-edit-read-reuse/verify.py
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -I -O -W error -B research/pinned-edit-read-reuse/verify.py
/Users/nick/git/integer-mult-bounds/.venv/bin/python3.12 -B scripts/check_research_commit.py --package research/pinned-edit-read-reuse --check-source-history

Use an installed CPython 3.12 path elsewhere. The direct verifier generates PASS_PINNED_EDIT_READ_REUSE with actual request/byte counters and source/package hashes. Set TMPDIR to an external scratch directory as needed. The README gives both complete scanner commands and the optional benchmark command.

Advance claim. Canonical main remained unchanged at submission. Live open PRs, claims, merged searches and main's README text were refreshed; sparse cached-note coverage was incomplete and is not a novelty certificate.

Limitations and unrun obligations

This is an opt-in tooling package. It changes no shared scanner, CI gate, frozen input or selected result. The equivalence proof assumes the predecessor's supported path/encoding contract and valid, stable Git objects. It does not preserve failures caused solely by a redundant read of a corrupt or concurrently removed object. There is no cross-scan cache.

The predecessor's broader source-reader admission and native Windows lifetime obligations remain separate. No supplier admission, selected cold replay, compiler/native/ownership/precision/tape/recovery proof, Lean or Docker check was run. All five selected framework assumptions remain. Independent human and formal proof-kernel review are unclaimed.

Open next questions

Can the tree-wide digest search avoid decompressing repeated objects while preserving binary/text treatment and every substring match? First specify a blob-ID deduplication algorithm, expand its matches back to every filename and compare one complete historical report. Those semantics are unresolved here; no further optimization was attempted.

Related open work

• Static check for in-place edits of hash-pinned bytes (flags #6318's 42 stale pins; no κ) #6319 supplies the original scanner, policy and proposed integration. This package adds a read-reuse step and leaves integration to that work.
• Repair PR6319 pinned-byte reads for multiline paths and Git context #6357 repairs exact path framing and repository selection. Its exact scanner is the retained predecessor; this result preserves that reader and does not deliver another repair audit.
• Use Windows Job Objects in the shared Git blob reader #5721 changes Windows process ownership in the shared Git blob reader. This package supplies no new Windows lifecycle contract or validation of that proposal.

CI notes

Both hosted checks passed at 40591325403a9897ca95f642345742d17b1bd2a0 in run 41537223436: plan in 4m36s and registered package replay in 2m8s. The completed checks were confirmed once; run metadata confirms the matching head, completed status and successful conclusion.

The registered replay executes both normal and optimized commands. Local normal/optimized behavior checks, registered replay, source pins and committed-byte/source-history checks also passed. Hosted success certifies execution of these bounded checks. Independent human and formal proof-kernel review remain unclaimed.

Merge Danger

Door: two-way.

Blast Radius: package.

Only research/pinned-edit-read-reuse/ is added. The shared scanner and selected frontier are unchanged.