# M12-04H Status

status: done
task: remove extraction staging on cancellation without modifying the committed project
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The production archive extraction transaction checks cancellation before staging, around every
payload read and write, and immediately before atomic commit. A pre-commit cancellation returns
`IO_ARCHIVE_CANCELLED`, removes every staged file, publishes no project, and re-reads the committed
project identity to prove that revision and SHA-256 did not change. Once atomic commit starts,
cancellation no longer converts the completed commit into a cancelled result.

Payload identity failure and staging creation/write failure use the same cleanup path. If cleanup
leaves a staged entry or the committed identity drifts, the transaction fails with
`STORAGE_TRANSACTION` instead of claiming successful cancellation.

## Evidence

- `npm --prefix web run test:library-archive-cancellation` passed 6/6 unit tests against real
  temporary directories.
- Cancellation before staging, after one staged file, and after the final staged write all leave
  zero staging files, zero published projects, and the original committed project bytes.
- The success path publishes revision 9 only after both staged payload hashes pass.
- Payload mismatch, rollback identity drift, stale revision, unsafe path, prefix conflict, and
  undeclared-field negatives fail closed.

## Artifact Hashes

- parent manifest: `c35e675e8f512e85b748f0b5578874fed8c99df7674a152e698236a67c9f4fa4`
- protocol: `c40adc1449172014cc1820db567e155828314abb404b66e4de13c26ddee06e4b`
- error codes: `751c70c898540fa7e82fb1b1a79254756ec8db8e4201a88b6d817d7c3d92103f`
- unit: `77e7d5bc64dd6b313006ebf523602601acdaf7949a1484da872ddcd046983786`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
- manifest: `7fce600a416aec5ade1a91a13d86caf4cb1f65b710054b59d525ff8b1d3c7409`

## Next Task

`M12-04I`: release temporary files after quota/OOM and allow a small archive to recover.

## Rollback

Remove the extraction transaction protocol, cancellation code, real-filesystem unit suite, manifest,
package command, and this status entry. Restore M12-04G as the queue tail and move the machine queue
back to `M12-04H`. No parity ledger rollback is required.