[suguanYang]

Summary

A segment could remain inside an active transfer after its configured budget. The reported result ZIP also contained a repeated resource with identical bytes.

Range archive -> verify duplicate resource bytes before uploads
segment deadline -> cancel active transfers -> checkpoint contiguous prefix -> pending
next segment -> resume that prefix -> publish after archive verification

Preserve the original directory identity for existing checkpoints. Conflicting duplicate paths fail before uploads; checkpoint persistence failure and caller cancellation remain failures. Immutable snapshot verification deduplicates resource hashes while checking every physical ZIP entry's CRC and size and the complete archive SHA-256. Includes a patch changeset.

Evidence

• Before: Active-entry deadline regression waited for the external watchdog and rejected; duplicate-resource regressions rejected identical resources or wrote objects before detecting conflicts. Review added immutable-snapshot regressions that failed during checksum verification.
  After: Deadline handoff saves the contiguous prefix and resumes without rewriting that prefix; checkpoint failure is propagated; identical repeated resources complete and conflicting bytes fail before uploads. Immutable snapshot checksum verification passes with and without the archive cache, including rereading a completed snapshot.
• Full SDK suite: 582 tests pass. Typecheck, changed-file ESLint, package build, and formatting pass.
• Hipo integration replay of the captured 145-page result archive completes locally after these changes and its Blob cancellation fix. The private archive is not committed; deterministic synthetic fixtures cover the regressions. Local replay is not production latency acceptance.

Merge Danger

Door: two-way

No migration. Original archive identity is retained for prefixes saved before a repeated entry. SDK publication is separate from the Hipo Web/API rollout.

Blast Radius: synchronization