fix(packages): reclaim unadopted legacy ZIPs

[SebTardif]

Rejected package publications could leave generated ZIPs that no release owned. Trusted idempotent retries could also return an existing release successfully while leaking a newly generated ZIP. This change delays allocation until insertion and reclaims only generated ZIPs that the release does not adopt. Committed archives and caller-supplied artifacts remain available after later failures.

Closes #3677.

The insertion result identifies reuse internally; publication and legacy finalization remove that marker before returning their public result. Concurrent pending insertions reject safely, while valid staged retries retain the existing attempt path. The existing plugin plan documents the ownership boundary.

Before/after proof

Used anonymous local Convex 1.44.0 at http://127.0.0.1:3460 / :3461: real stored files, publisher/token/package/release rows, publication actions, insertion mutations, and HTTP downloads. No mocked storage or action context.

Case	Before	After
Rejected direct insertion	One orphan ZIP	Zero new blobs
Rejected staged duplicate	One orphan ZIP	Zero new blobs; allocation avoided
Trusted retry reuses existing release	Original patch leaks another 923-byte ZIP	Zero new blobs; same release/archive; original ZIP remains HTTP 200/923 bytes
Successful direct/staged publication	Archive retained	Archive retained and downloadable
Downstream error after commit	Adopted archive retained	Adopted archive retained and downloadable
Caller-supplied tarball on success/duplicate	Tarball retained	Same storage ID/hash; storage set unchanged
Concurrent pending insertion finds existing row	Focused baseline returns reused row	Actual mutation rejects; storage/release/attempt state unchanged
Pending release has no check attempt	Existing cleanup/retry path	Real orphan is removed; fresh upload of the same package/version creates a new pending release and attempt

The core baseline is main a230dae1b7; the retry baseline is the original patch integrated with main 0ef3e59e53. The downstream-error case deliberately injects a local-only error into the scan-enqueue mutation after the actual release commit. This is fault-injection evidence, not a production incident. All temporary fixture/injection changes were removed before validation.

Validation

• Four new regressions fail before repair; all 379 focused package tests pass after.
• bun run ci:static, bun run ci:unit (6,951 passed, 3 skipped), bun run ci:packages, and bun run ci:types-build pass.
• Explicit schema, CLI, and Convex tsc --noEmit checks pass; the clean function set pushes to the disposable runtime with typechecking enabled.
• Independent source review found no actionable issues. Full-branch autoreview raised one orphan-recovery concern; it was rejected after the native recovery case above and confirmation that the relevant cleanup branch is byte-identical to main. No accepted/actionable findings remain.

Contributor history is preserved with a normal merge from main. Current-head hosted checks must pass before landing.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

@SebTardif is attempting to deploy a commit to the OpenClaw Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 16, 2026, 1:01 AM ET / 05:01 UTC (Revision 3).

ClawSweeper review

What this changes

Package publishing now delays generated ZIP storage until release insertion and deletes unadopted archives after rejection or release reuse, with regression tests and documented ownership rules.

Merge readiness

✅ Ready for maintainer review

The fix remains necessary: current main and the latest release retain the early ZIP allocation. No blocking findings remain, and the updated real Convex results satisfy the previous proof request.

Priority: P2
Reviewed head: de5140cc0e567272bd3e5886ffb85da35db5f853

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused repair with ownership regression coverage and relevant real-backend results, with no blocking findings.
Proof confidence	🐚 platinum hermit (4/6)	Sufficient (live_output): Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (live_output): Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.
Evidence reviewed	9 items	Verified patch scope: The pinned merge-base-to-head diff changes three files: publication logic, regression tests, and the plugin specification. Local inspection matches the supplied introduction evidence; git status remained clean. Current main still has the leak: Current main stores the generated ZIP before staged duplicate checks and release insertion, without the proposed ownership-aware cleanup wrapper. Latest release retains early allocation: The v0.23.3 source also stores legacyZipStorageId before constructing release insertion arguments; no released implementation of this repair was established.
Findings	None	None.
Security	None	None.

How this fits together

ClawHub package publication turns authenticated uploads into release records and downloadable archives. This change controls when generated ZIPs become release-owned and which temporary archives can be deleted.

flowchart TD
  A[Authenticated package upload] --> B[Validate package and check retries]
  B --> C[Return existing attempt or reject duplicate]
  B --> D[Store generated ZIP when needed]
  D --> E[Insert release]
  E -->|Rejected or reused| F[Delete newly generated ZIP]
  E -->|Created| G[Retain archive for scans and downloads]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch size	+351/-38 across 3 files	The branch stays within publication logic, focused regressions, and its ownership specification.
Production and test delta	Production +75/-38; tests +265/-0; specification +11/-0	Production growth supports shared ownership-aware cleanup and internal-result compatibility.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3677
Summary: This PR is the candidate repair for generated legacy ZIP leakage; multipart upload cleanup and retained-release recovery have distinct ownership boundaries.

Members:

• canonical: Package publish leaves a legacy ZIP after a rejected release #3677 - The paired tracker describes the exact generated-ZIP leak addressed by this branch.
• adjacent_distinct: Multipart package publish leaves Convex blobs after a failed publish #3673 - Tracks request-uploaded files and tarballs in the multipart HTTP handler.
• adjacent_distinct: fix(publish): recover failed staged release artifacts #3616 - Merged recovery work handles retained releases and their existing artifacts.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Keep cleanup at the action-to-release ownership boundary, preserving committed archives and caller uploads through retries and downstream failures.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: a valid legacy package publication stores a ZIP before duplicate rejection or failed insertion on current main. The contributor supplies real before/after Convex results; this read-only review did not execute the path.

Is this the best way to solve the issue?

Yes. Cleanup beside archive creation and insertion is the narrowest repair; HTTP-wide cleanup could delete committed uploads, while pending-release cleanup cannot discover an unattached ZIP.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f96495690dad.

Labels

Label changes:

• add proof: sufficient: Contributor real behavior proof is sufficient. Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.
• remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.

Label justifications:

• P2: Rejected authenticated publications can accumulate unused storage, without evidence of an outage or widespread user blockage.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.
• proof: sufficient: Contributor real behavior proof is sufficient. Captured local Convex results exercise the changed publication action and insertion mutation with real storage: rejected/reused publications leave no new blobs, while successful and post-commit-failure archives remain downloadable. Caller-tarball preservation and pending-race rejection also address the relevant ownership boundaries and prior proof request.

Evidence

What I checked:

• Verified patch scope: The pinned merge-base-to-head diff changes three files: publication logic, regression tests, and the plugin specification. Local inspection matches the supplied introduction evidence; git status remained clean. (convex/packages.ts:9309, de5140cc0e56)
• Current main still has the leak: Current main stores the generated ZIP before staged duplicate checks and release insertion, without the proposed ownership-aware cleanup wrapper. (convex/packages.ts:9268, f96495690dad)
• Latest release retains early allocation: The v0.23.3 source also stores legacyZipStorageId before constructing release insertion arguments; no released implementation of this repair was established. (convex/packages.ts:8648, 87ca030c30f3)
• Ownership and finalization boundaries: Cleanup captures only the ID returned by this action's storage.store. Successful insertion exits that cleanup boundary before downstream work. Pending insertions reject existing versions, and legacy finalization strips the internal reuse marker before passing the strict result validator. (convex/packages.ts:9330, de5140cc0e56)
• Download and existing cleanup contracts: Package downloads read the stored release archive and return an error if that referenced archive is missing. Existing pending-release cleanup discovers IDs from a release record, so it cannot replace cleanup for a ZIP that was never adopted. (convex/httpApiV1/packagesV1.ts:4827, de5140cc0e56)
• Updated real behavior evidence: The complete captured PR body under sourceRevision ba2cfc6d2b73102c774beb45af6477afd8e0f4cbd82abd4409fb2264a75db07d reports real local Convex 1.44.0 publication actions, insertion mutations, storage, and HTTP downloads. Results include zero new blobs after rejection/reuse, preservation of the original HTTP-200 923-byte archive, retained successful archives after injected downstream failure, unchanged caller tarballs, and pending-orphan recovery. These directly address the prior requested storage and download proof. This review did not execute target code. (de5140cc0e56)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• giodl73-repo: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Patrick Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-07T22:13:34.063Z sha d25c99f :: needs real behavior proof before merge. :: none
• reviewed 2026-09-11T14:08:53.636Z sha d25c99f :: needs real behavior proof before merge. :: none