[matrixarkai]

restore_until_ms, retention_until_ms and legal_hold describe an object under a restore,
a retention or a legal hold. Most objects are under none, and paid sixteen bytes of struct to
say so.

	was	now
ObjectProjection	72	64
the metaserver's share	200	192
the metadata line	418	410 (fixed term unchanged)

ObjectLock already makes this argument on the object side — its own doc says an object
under none of the three should pay eight bytes rather than twenty-five — and this is the same
argument one level in.

It is small because the projection has one builder and one reader

from_metadata is the only place a projection is constructed, and to_text the only place
its fields are read. So the change is two functions and three accessors, and zero compile
errors followed it.

to_text is also the wire form — a record's value is its rendered characters, which is
what every proof and every snapshot carries — so the text is unchanged and
the_packed_projection_spells_the_same_text passes untouched. A representation change.

The audit had to move or the figure would be a lie

RecordValue::heap_bytes charged a projection size_of::<ObjectProjection>() and nothing
else. With the holds behind a pointer that under-reports every object that has one, which
would publish a saving those objects did not get. It charges holds_heap_bytes() beside the
struct now.

The hazard the box creates, and the guard for it

RecordValue compares Projection to Projection with a derived PartialEq. So a
None box and an all-zero box would be different values while spelling identical text —
and the type's own doc says two values that spell the same thing are the same value.

from_metadata therefore builds the box only when one of the three is set, and
a_projection_holds_nothing_for_an_object_under_no_hold asserts that rather than trusting
the .then(..) to keep saying so:

• an object under none owes zero heap and still spells restore_until_ms=0,
  legal_hold=false, retention_until_ms=0;
• an object under a legal hold does owe the box — so the zero above is about that object,
  not about an accessor that always returns zero;
• and the two are different values, which the derived equality must still see.

It is pinned: an equality invariant that a document depends on belongs in the pinned set.

Five mirrors were measuring against the old baseline

Across two measurements, five mirrors spelled the three holds inline. Left alone, one of them
read as saving minus eight — a number that looks like a result and is not. They follow
the landed baseline now, and they name the real ProjectedHolds instead of a local copy: a
mirror of a real type should name that type where it can, because a local duplicate is one
more thing to drift.

The figures, each re-measured

4 KiB amplification row	3.12x → 3.11x; striped 2.10x → 2.09x
metadata an object at 100 / 1,000 / 4,000 / 8,000	618 / 574 / 451 / 430
delete trade	holding 1,831,649, emptied 2,300,662, 25.5% → 25.6%
the share table	objects 210 (51.2%), records 192 (46.8%), keys 8 (2.0%)

Measured

• Suite: 408 passing on the default feature set, 429 with every feature, the same 21 failures in both and name for name the baseline in tools/known_failures.txt
• cargo build --all-targets --locked and --all-features, RUSTFLAGS=-D warnings — green
• cargo doc --no-deps --locked and --all-features, RUSTDOCFLAGS=-D warnings — green

🤖 Generated with Claude Code