Native package CLI: activate owned update and outdated commands

Refs #66, #713 and historical update milestone #189.

Completed native-mode update/outdated activation and verification. Source commits 8edab44 through 831196d connect Home's owned command implementations and port interactive stdin/manifest I/O, version writers, synchronized rendering, timing, table exports, command output flushing, and semver's real color output.

Acceptance verified on runtime source 831196d (production build 46/46): unchanged original update 6/6, outdated selection 16/16 with all nine snapshots, interactive update 31/31, and semver 25/25. Pinned Bun passes the same 78 cases. Sources/snapshots stayed unchanged, and the 214 filtered registry cases are not counted as coverage. Real-registry native regression also passes --force discovery, ordinary/--latest updates, interactive decline/accept, actual installed versions, archive integrity and frozen lock validation.

Historical failures are retained: inactive dispatch, unported compile surfaces, missing output flush, eight missing semver color snapshots, and private fixture mistakes. The latter were corrected against observed layouts and the actual optional asynchronous manifest-cache contract; no original tests were weakened. See the final checkpoint comment for exact scope and source hashes.

Evidence: docs/docs/bun-port-evidence/2026-09-08-native-package-complete/ in b740117, alongside retained earlier batches. All changes are pushed to origin/main as Chris Breuer without coauthors. This is native-mode package-command completion; full Bun parity remains open in #66.

Native package repair batch in progress; all source changes are pushed to origin/main through 24bdc3e.

• #713 is reproduced again on the actual 6053c6c executable. The new regression inspects raw package.json and catches both duplicate keys directly, rather than accepting JSON.parse's last-key result. Local folder names are now resolved before the first package edit, and multiple paths naming the same package retain the existing first-request precedence. Coverage includes all dependency groups, path forms, explicit aliases, normal replacement, later frozen install/remove, and workspace-relative arguments.
• New #716 tracks native update/outdated activation. The actual native-mode outdated command previously reported all packages up to date even after a local registry published a newer version. Both commands now route to Home's owned runtime implementations. The regression checks registry discovery, real gzip/integrity-checked archives, ordinary and --latest upgrades, interactive acceptance/decline, and installed contents.
• Production compilation exposed missing public command exports and unported interactive I/O/rendering. Those first build failures are retained. The command exports, stdin and manifest-file I/O, version writers, and synchronized terminal frame rendering have been ported; the next build is underway. Neither issue is accepted as fixed until the actual native batch passes.

The earlier #713 raw fixture directory was lost in the previously reported worktree incident; its issue body now explicitly states that instead of claiming it still exists. Fresh logs remain outside disposable worktrees, and completed results will be committed with the checkpoint. No upstream test or snapshot has been altered, no frozen validation removed, and no package operation delegated to Bun.

Native package batch checkpoint, pushed to origin/main through 5e1d775:

• Production native build passed 46/46 steps on source 6a183ad (Home SHA-256 4401f12d1335d21039cd2a796a1a86b12331c9ddd0c64f4eaaea57957a5713d6).
• #713 is now verified: the corrected raw-key/installed-content regression passes all dependency groups, folder path forms, replacement/alias/dedup cases, and workspace-relative behavior, including later frozen install/removal. Pinned Bun still reproduces the duplicate workspace metadata/frozen-lock failure. Its failure is retained, not accepted as logical parity.
• Unchanged original bun-update.test.ts: Home 6 registered passes, pinned Bun 6, no failures. Duplicate gate summary lines count once. Frozen-prerelease regression remains passing.
• Unchanged original outdated selection: Home 0 pass/16 fail; pinned Bun 16 pass/0 fail. Sources and snapshots stayed unchanged. Home emits the version banner but loses the table. a6d65e2 flushes Home's buffered native command output before returning; that build is in progress.
• Two private fixture assumptions were corrected transparently: workspace local packages install inside workspace node_modules, and ordinary outdated honors Bun's five-minute manifest cache. The live registry regression now explicitly checks the cache hit, public --force refresh, and cached refreshed output. Its earlier immediate-refresh assertion is not treated as a valid compatibility requirement. Remaining interactive acceptance/decline and real update/archive/frozen operations succeeded in a diagnostic that isolated the known outdated failure; that diagnostic is not reported as a full regression pass.

All first failures, successful build log, exact test revisions, snapshot checks, and comparison fixture archive are committed in docs/docs/bun-port-evidence/2026-09-08-native-package-verification/. #716 stays open pending the corrected full batch. The full Bun port, inventory/profile/platform coverage, and other open native gaps remain incomplete.

Native output follow-up, pushed to origin/main through c0b8729:

The a6d65e2 native build passed all 46 steps. Its executable SHA-256 is a075ffc9fc860fe50d7d49a9efa5acb146b00da93e7f0c71daa41df9bb5cbea2.

• All three native regressions pass: local dependency identity, real-registry update/outdated cache/force behavior and interactive accept/decline, and frozen prerelease integrity.
• Unchanged bun-update.test.ts: Home 6 pass, Bun 6 pass.
• Unchanged update_interactive_formatting.test.ts: Home 31 pass, Bun 31 pass, including real workspace/catalog update operations. The first formatting-only cases make weaker no-crash assertions; those are not claimed as additional behavior coverage.
• Original outdated selection improved from 0/16 to 8/16 in Home; Bun remains 16/16. Eight exact colored snapshots still fail because semver/shim.zig hardcodes enable_ansi_colors_stdout=false and leaves formatting markup unimplemented. The emitted package/version contents are now present; failures are missing version color spans. Sources and snapshots remain unchanged, and the full first and second outcomes are retained.

831196d removes that output stub and connects semver to Home's configured native output support. Its production build is running. The next batch will rerun these original files plus the semver cases. #716 remains open until verified. Evidence for the completed batch is committed under docs/docs/bun-port-evidence/2026-09-08-native-package-output/. #713 remains closed after the full corrected regression passed again. The overall #66 goal remains incomplete.

Verified native package milestone, pushed through b740117 to origin/main.

Runtime source 831196d builds all 46/46 production steps. Home executable SHA-256: ccbce30778cbaedec1446fbf13c5040363919f5ec1bb19149693518268956ce4. Pinned Bun control SHA-256: 47a87c1dea30da59c2733cce80118ea59bd338c616c6378f1c7f55e5f2b92c87.

Unchanged original cases, in each runtime:

• update: 6 passed, 0 failed.
• outdated selection: 16 passed, 0 failed, all nine snapshots passed. The other 214 cases in that file were filtered and are not counted as executed.
• interactive update: 31 passed, 0 failed, including workspace/catalog operations; the initial six no-crash formatting cases have narrower assertions.
• semver: 25 passed, 0 failed.

That is 78 registered cases per runtime, counting duplicate native-gate summary lines once. Test sources and snapshots stayed unchanged. Three private native regressions pass separately: raw local dependency identity/frozen/remove behavior; real-registry --force discovery, update/--latest, interactive accept/decline, archive integrity and installed contents; and prerelease frozen-lock integrity.

#713 is fixed by resolving local package identity before edit/install. #716 is fixed by activating the owned update/outdated commands, porting their interactive I/O and formatting, flushing native command output on return, and replacing semver's hardcoded color/output stub with Home's configured output. No lock validation or original assertion was bypassed.

The final private cache-contract correction is explicit: Bun's Serializer.saveAsync documents that disk-cache writes are optional background work and need not finish before CLI exit. The previous private assertion requiring the refreshed generation to be persisted was invalid and its first failure remains archived. f65eb22 tests the supported --force freshness guarantee and actual operations without demanding optional persistence. It passes on the same 831196d executable; the other original tests were not retried to turn that assertion green.

Final evidence is committed in docs/docs/bun-port-evidence/2026-09-08-native-package-complete/, including exact source revisions, command/result manifests, failed historical private outcome, corrected test, logs, hashes, and the cache-contract source excerpt. Generated Verdaccio databases and the two owned diagnostic fixtures were archived before cleanup.

This closes the scoped #713/#716 work. The overall #66 goal remains incomplete: native-mode gating/default fallback removal, full pinned inventory and upstream CI/platform profile, #438 JSX, #190 self-upgrade, native link/unlink activation, independent native build ownership, and other tracked gaps remain.