build(deps): update crawlkit to v0.16.7

[vincentkoc]

What Problem This Solves

Discrawl still pins Crawlkit v0.16.6 and misses the v0.16.7 snapshot sidecar fix.

User Impact

User impact: case-only sidecar directory renames no longer risk pruning the newly copied file on case-folding filesystems.

Why This Change Was Made

Updates only go.mod and go.sum to consume the compatible Crawlkit patch.

Evidence

• Store, config, and CLI focused tests passed.
• Module verification passed.
• The local publication transport suite hit its existing 10-minute synthetic-Git timeout; hosted exact-head checks provide the authoritative clean-environment result.
• Hosted exact-head checks are tracked on this draft.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 1, 2026, 4:28 AM ET / 08:28 UTC.

ClawSweeper review

What this changes

Updates Discrawl’s shared archive library, Crawlkit, to v0.16.7 and replaces its module checksums.

Merge readiness

✅ Ready for maintainer review

Keep open: current main still pins Crawlkit v0.16.6, so this update remains distinct. The narrow dependency delta has no identified correctness or security defect, and the member-authored PR requires no cleanup closure.

Priority: P2
Reviewed head: c3891e491210e62db2a6c4a866cf0171788d0810

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused compatible dependency update with supportive upstream runtime evidence and no actionable patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor-proof gate is exempt for this MEMBER-authored PR. Independently, upstream’s APFS terminal trace exercises the changed sidecar owner and shows file retention plus stale-file removal; no stored-data contract changes were found.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor-proof gate is exempt for this MEMBER-authored PR. Independently, upstream’s APFS terminal trace exercises the changed sidecar owner and shows file retention plus stale-file removal; no stored-data contract changes were found.
Evidence reviewed	7 items	Pinned introduced delta: The verified merge-base-to-head diff changes only the Crawlkit requirement from v0.16.6 to v0.16.7 and its two checksums. The verified test merge has the same two-file result. Still necessary on main: Fetched main, also identified in the supplied context as release v0.15.6, still requires Crawlkit v0.16.6. The open-PR search returned only this PR for Crawlkit or sidecar updates. Dependency boundary: Discrawl directly imports Crawlkit’s snapshot package and calls snapshot.Export. Its documentation assigns snapshot packing/import to Crawlkit. A search of the inspected share implementation found no direct SyncSidecarTree call; Discrawl media publication uses its own compression path.
Findings	None	None.
Security	None	None.

How this fits together

Discrawl uses Crawlkit to pack and import local Discord archives as Git snapshots. This update brings in a shared sidecar-file pruning fix, although Discrawl’s inspected publication paths do not directly call the changed sidecar helper.

flowchart LR
  A[Local Discord archive] --> B[Discrawl publication]
  B --> C[Crawlkit snapshot library]
  C --> D[Git snapshot]
  D --> E[Discrawl subscriber]
  E --> F[Local searchable archive]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Consume the narrow tagged patch while preserving Discrawl’s existing publication formats, privacy filters, and media handling.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the dependency bump itself. Upstream supplies a concrete APFS reproduction and after-fix trace, but the inspected Discrawl paths do not directly invoke the changed helper.

Is this the best way to solve the issue?

Yes: updating the version and checksums is the narrowest way to consume this compatible upstream patch; duplicating its implementation in Discrawl would add unnecessary maintenance.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against cd7fa1ce5eb7.

Labels

Label changes:

• add P2: This is a bounded shared-library maintenance update with no demonstrated urgent Discrawl regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this MEMBER-authored PR. Independently, upstream’s APFS terminal trace exercises the changed sidecar owner and shows file retention plus stale-file removal; no stored-data contract changes were found.

Label justifications:

• P2: This is a bounded shared-library maintenance update with no demonstrated urgent Discrawl regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor-proof gate is exempt for this MEMBER-authored PR. Independently, upstream’s APFS terminal trace exercises the changed sidecar owner and shows file retention plus stale-file removal; no stored-data contract changes were found.

Evidence

What I checked:

• Pinned introduced delta: The verified merge-base-to-head diff changes only the Crawlkit requirement from v0.16.6 to v0.16.7 and its two checksums. The verified test merge has the same two-file result. (go.mod:11, c3891e491210)
• Still necessary on main: Fetched main, also identified in the supplied context as release v0.15.6, still requires Crawlkit v0.16.6. The open-PR search returned only this PR for Crawlkit or sidecar updates. (go.mod:11, cd7fa1ce5eb7)
• Dependency boundary: Discrawl directly imports Crawlkit’s snapshot package and calls snapshot.Export. Its documentation assigns snapshot packing/import to Crawlkit. A search of the inspected share implementation found no direct SyncSidecarTree call; Discrawl media publication uses its own compression path. (internal/share/share.go:97, c3891e491210)
• Complete dependency patch review: The v0.16.6-to-v0.16.7 comparison contains only release notes, the sidecar keep-path repair, and regression tests. The repair records actual directory-entry spelling for pruning while retaining source spelling in manifests; exported APIs, schemas, and dependency requirements are unchanged. (snapshot/sidecar.go:119, 79093661fdc9)
• Upstream real behavior evidence: Merged fix(snapshot): keep sidecar files after a case-only rename crawlkit#147 includes a terminal trace from macOS APFS exercising SyncSidecarTree after the fix: case folding was confirmed, the manifest path returned new bytes, and the stale sibling was gone. This supports the dependency repair, rather than establishing a Discrawl-specific reproduction. (e61b9d017497)
• Tagged dependency and policy: The annotated v0.16.7 tag resolves to the release-preparation commit. Crawlkit’s full root AGENTS.md was read because Discrawl directly consumes its snapshot contract; the patch preserves its compatibility guidance. No snapshot-scoped AGENTS.md was returned. The release endpoint returned 404, so tag existence is established without claiming GitHub Release publication. (AGENTS.md, 33d2d16c9b97)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.