GeezerVison

Fixes #559.

Removing one patch could delete the only local rollback data for other patches left active. remove and rollback built different garbage-collection keep sets: only rollback retained every remaining patch's original blobs. A later offline rollback then failed with missing_blob, even though the earlier removal had reported success.

Both commands now use ArtifactReferences::after_removal in core. It retains patched bytes for remaining patches, original bytes for remaining and removed-but-not-installed patches, and the corresponding diff archives. Artifacts referenced only by successfully removed patches remain collectible. Repair and scan pruning use the same sweep with their existing apply-only retention policy.

This removes 29 production lines net, the synthetic #beforeHash-pin file records, and duplicate retention rules. Cleanup operates on explicit sets of blob hashes and patch UUIDs rather than cloned patch records with rewritten hash fields. A real filename ending in #beforeHash-pin can no longer collide with a synthetic keep record. The artifact sweep also moves from the rollback command into core; commands retain their existing error reporting and partial-cleanup behavior.

Validation on 2e403800:

• The new offline lifecycle regression fails on the base (remove swept the remaining patch's rollback data) and passes after the change. It covers normal remove, remove --skip-rollback, and scoped rollback: remove one of two installed patches, verify the other's manifest and blobs survive, then restore it offline.
• 25 core cleanup tests passed. New filesystem coverage checks apply/removal retention, crawler misses, missing records, created files, filename collisions, archive retention, and dry-run/wet agreement.
• 314 command and lifecycle tests passed across remove, rollback, repair, rollback coverage, and in-process remove/repair; one existing test is ignored.
• 28 scan GC unit tests, eight pruning integration tests, and four scan lifecycle tests passed.
• Workspace/all-features Clippy passed with -D warnings -A unused-variables; the allowance covers the existing macOS warning at python_crawler.rs:1950. Strict CI Clippy also passed. Changed code is formatted and git diff --check passes.

Full CI, all compatibility workflows, and the benchmark comparison passed: all 486 checks and all 13 workflows completed without failure on the final commit. All 39 benchmark scenarios were classified unchanged. The PR has been converted from draft to a regular PR; the automatic Bugbot review passed with no findings.

Selected after refreshing all 146 open issues, six open PRs, and the 20-comment architecture discussion #560. No open PR covered #559. The discussion identifies duplicated removal/rollback orchestration; sharing its retention policy fixes data loss across package managers in one focused change. Development uses a separate worktree.

Generated by Claude Code