Preserve the current executable owner when unlinking a package

Refs #66 and the native activation milestone #717.

A real isolated control reproduces a logical ownership bug in both Home and pinned Bun. Register package native-owner-a with bin shared-native-command pointing to owner-a/cli.sh. Register native-owner-b with the same bin name. The bin now correctly resolves to owner-b/cli.sh. Run argument-free unlink from owner-a. It exits zero and removes shared-native-command, while native-owner-b remains globally registered. Both package sources remain intact, but B has lost its active command.

Home runtime source e56d48e, executable SHA-256 56ea320b3204e0ab5535991c6088c6e2043fa84f26b54fcaacf6d68484fc6296. Pinned Bun SHA-256 47a87c1dea30da59c2733cce80118ea59bd338c616c6378f1c7f55e5f2b92c87. Both controls report removed_other_packages_current_bin=true. This shared failure is not accepted as logical parity.

The likely cause is packages/runtime/src/install/bin.zig: Bin.Linker.unlink builds each destination name and calls unlinkBinOrShim unconditionally. Unregister must remove only the bin that still belongs to the package being unregistered, preserving a later provider's link/shim and unrelated physical files. Do not implement this by deleting/recreating the other package's metadata, skipping all bin cleanup, or silently disabling the Windows branch.

Acceptance: add failing ownership regressions; compare actual current bin targets to the expected provider before deletion; cover supported single-file, named-file, map and directory bin declarations; preserve another provider and unrelated files; still remove the package's own links/shims and preserve sources; retain native link/binlink original test passes and prior package regressions. Verify relevant platform representations, and keep unverified platform scope explicit.

The diagnostic uses explicit private BUN_INSTALL_GLOBAL_DIR/BUN_INSTALL_BIN/cache prefixes. Its full command output, before/after targets, exact executable hashes, source script, and both fixture archives are retained under zig-out/bun-port-recovery/link-bin-ownership and will be committed with the checkpoint. Both temporary fixtures were archived before cleanup. #717 tracks the completed activation and existing-test milestone; this issue tracks the newly demonstrated remaining logical defect.

Native link/unlink activation checkpoint is verified and pushed through bc3abc3 to origin/main.

Runtime source e56d48e built all 46/46 production steps. Home SHA-256: 56ea320b3204e0ab5535991c6088c6e2043fa84f26b54fcaacf6d68484fc6296. Pinned Bun control SHA-256: 47a87c1dea30da59c2733cce80118ea59bd338c616c6378f1c7f55e5f2b92c87.

• Unchanged original bun-link.test.ts: Home 4 passed / 0 failed; Bun 4 / 0.
• Unchanged original bun-install-native-binlink.test.ts: Home 7 passed / 0 failed; Bun 7 / 0. This includes executable-target containment and preservation of outside-file contents/modes.
• Four native regressions pass: new full link lifecycle, prior local dependency identity, real-registry update/outdated/interactive behavior, and frozen-prerelease integrity. The new lifecycle covers plain/scoped packages and workspaces, global registration/consumption, real executable targets, live linked contents, --save, frozen install/remove, repeated register/unregister, every bin declaration form, and preservation of source/physical unlinked packages.

These are 11 registered original cases per runtime, counting repeated gate summaries once. Sources and snapshots stayed unchanged. All eight run-global prefixes were archived then removed; the private regression also cleaned its own prefix. The actual build/tests ran on macOS arm64. Native VM gating and the full platform/corpus/profile/build-ownership work remain open.

An additional ownership control found a shared logical defect in both executables: after A and B register the same command name, unlinking A removes B's current bin while B remains registered. This is confirmed in new #718, with the exact commands, before/after targets, hashes and both fixture archives committed under docs/docs/bun-port-evidence/2026-09-08-link-bin-ownership/. Shared upstream breakage is not accepted as passing logical parity. That defect remains open for the next repair.

The activation and existing-case milestone #717 is complete; #718 and the full #66 goal remain incomplete. Successful evidence is under docs/docs/bun-port-evidence/2026-09-08-native-links-verified/, and all first command/build failures remain under 2026-09-08-native-links/. Accounting is in docs/docs/bun-native-link-baseline.json. All commits use Chris Breuer's identity without coauthors.

Implemented the first ownership repair in 747a7ef75, pushed to main as Chris without coauthors. All four bin declaration forms now compare the actual symlink target with the declared target before deletion. This preserves later providers and physical replacements while allowing cleanup of owned dangling links. Windows cleanup checks a validated .bunx target and only deletes an .exe whose bytes still match the installed embedded launcher.

The new process regression reproduces the old failure before the fix. The platform-independent Windows metadata parser tests pass, including malformed lengths/truncations, and Pickier passes. Production native build and the combined link/package regression batch are running; no runtime pass is claimed yet. Windows execution remains unverified. Prior failure evidence remains preserved. Refs #66, #717, #718.

Initial production build 747a7ef75 passed 46/46. The eight other commands in the combined batch passed: four existing private native regression files and both original link files in Home/pinned Bun (11 original cases per runtime), with original sources/snapshots unchanged.

The new ownership regression got past collision preservation, normal removal and physical-file preservation, then failed removal of an owned dangling absolute link spelled through macOS /var rather than canonical /private/var. This is a real cleanup defect, not a reason to weaken the test. Fix b3e4101b2 resolves target parent directories after lexical comparison, preserving cleanup when the target file itself is missing. The second build includes that fix plus #719 patch command activation and is pending.

All initial logs, runner manifests, diagnostics and fixture archives are committed in the initial evidence manifest, pushed in fa40ab41a. Windows metadata parser tests pass; Windows filesystem execution remains unverified. Refs #66.

The ownership regression now passes completely on macOS arm64 in runtime b61c84476 (Home SHA-256 74a9255f91b025686c7146a2bc7dc5c2ec69afe2e71a48a5458a11acdff8d7f6). It covers all four bin declarations, later-provider collisions, current-owner removal, physical replacements, owned absolute/dot-segment links with deleted file targets, and source preservation. The /var alias cleanup failure from the first implementation is fixed by resolving target parents without requiring the target file to exist.

Build 46/46. All six private native regressions pass, and unchanged original link/binlink files pass 11 cases per runtime with no snapshot/source changes. Windows metadata validation tests pass on this host; native Windows filesystem execution remains unverified, so that platform verification scope is still open. Committed build/test evidence, pushed in 684618a7c.

The next build batches #719's remaining command usage/SystemError formatting ports. It will rerun the ownership regression too. Refs #66.

Verified in runtime a4b73596f5ac51e1a59e330caa5a431becfa04bc, published with evidence in d05001718 on origin/main as Chris without coauthors. Home SHA-256: f6e39e7f52e551a2ec0e3e9e4e990d06e2c4e14a4d696701fc77554f5536e526.

Production build 46/46. Both complete original patch files pass 47/47 in Home and pinned Bun (29 patch + 18 install-patch), including all four previous diagnostic failures. Both original link suites remain 11/11 per runtime. All six private native regression files pass, including the eight patch variants and bin ownership. Sources and external/inline snapshots remain unchanged; original patch JUnit case counts independently match 29 and 18.

Final committed evidence, patch baseline. Earlier failures remain in separate committed bundles. Generated per-run temp/cache directories and registry data were cleaned up; logs, JUnit, inventories, and relevant global fixture archives remain retained. macOS arm64 is verified; platform-wide execution, full corpus/CI accounting, default fallback removal and independent build ownership remain open under #66. #718 retains Windows filesystem verification.

Closing as implemented and integrated on current origin/main 373f561f9. Both ownership repairs (747a7ef75 and the canonical-parent alias fix b3e4101b2) are ancestors of main. The current unchanged Home-owned native-link-bin-ownership.test.mjs was revalidated under HOME_NATIVE_VM=1 and passes, covering later-provider collisions, owned removal, physical replacements, all declaration forms, dangling/aliased targets, and source preservation. Darwin filesystem behavior and platform-independent Windows metadata parsing are verified; native Windows filesystem execution remains explicit platform scope under #66 rather than an unresolved implementation defect here.