fix(storage): preserve authenticated UUID ownership in CAS mutation workspaces

[DecisionNerd]

Constructed CAS graphs rejected ordinary and qualified CREATE because hydrated v5 UUID controls had shared inodes, while mutation planning required private ownership. Copy the mutable manifest/receipt through the existing bounded authenticated materializer; keep immutable runs shared only under readonly, retained-identity and digest/block checks. Private construction guards remain strict.

Public regressions cover flat/sharded parents, repeated CREATE/DELETE and surrogate allocation, qualified node/edge ownership, active snapshots, exact reopen/query/export/verify/import, and eight crash/returned-error publication cases. Adversarial tests cover aliases, writable transitions, mutated bytes and path replacement. Exact copy-I/O assertions and deterministic control/allocation budgets accompany source-bound CPU, I/O, RSS and sampled workspace evidence in the assessment.

This repair preserves the shared permanent Parquet policy. Same-name adoption atomicity, bound-composition clear and post-compaction facade refresh remain separate blockers under #1221.

Validation: 54 membership and 38 object-store unit tests; final adversarial authentication test; 733 API unit tests plus the corrected exact-control regression; all 24 public publishing tests; workspace Clippy, formatting, fast pre-push and gate-registry checks. Independent review verified the Windows retained-handle test behavior. The Windows/macOS jobs explicitly run the new shared-run authentication and exact private-control tests. Real 1×/2×/4× lifecycle qualification accounts exact authenticated control bytes before enforcing ordinal-copy bounds, with omitted/excess-work regressions. Workflow lint passed; required exact-head CI remains the merge gate.

Closes #1228

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 6210d13f-702d-4670-958a-66f0e1b4af72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

Billing warning: we have not been able to collect payment for this subscription for more than 72 hours. Please update the payment method or pay any pending invoices in Billing to avoid service interruption.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}