safe-fs: quota delta misses growth through hard-linked file aliases

[kamilio]

Separate concrete finding from the #579/#603 review; not included in the symlink-referent fix.

Minimal in-memory reproduction through withFileSystemQuota(raw, {maxBytes:128}):

await quota.writeFile("/a", new Uint8Array(1));
await quota.link("/a", "/b");
await quota.writeFile("/a", new Uint8Array(100));

Both entries now report size100 (same inode), so the wrappers existing namespace-based usedBytes census reports200 while the configured ceiling is128. The admission delta only accounts for one entry. This is a logical namespace-accounting inconsistency, NOT evidence of200 physical bytes or duplicated backing storage. Define and preserve the intended hard-link accounting domain, then validate writes/appends/truncation and provider identity/unknown-identity behavior before changing code. The current small reproduction was executed without external filesystem writes.

[kamilio]

Taking #604 for bounded in-memory validation and a namespace-accounting fix. Existing quota census counts every namespace entry, not unique physical storage. I will preserve that domain, account for all aliases affected by content growth, and explicitly handle unavailable identity evidence before writes. Existing symlink fixes, copied-provider identity contracts and partial streaming effects will remain covered. No host filesystem or large allocation probe is needed.

[kamilio]

Delivered to origin/main at ed2a6fa; remote SHA verified before this immediate post-push closure. Reproduced the reported 1-byte/two-hard-link to 100-byte write escaping a 128-byte logical namespace quota. Positive existing-file growth now charges every visible same or unknown file alias using complete identity tuples or optional compareEntry; invalid comparison results fail before writes, while unknown identity is conservative. Shrinks retain single-entry credit so overlay copy-up cannot create unsafe multiplied credits. Cancellation and comparison error identities are preserved. TDD includes writes/appends/truncation/copy/streams, identity scopes, repeated mounts, unknown/invalid comparisons, and copy-up controls: 38 quota tests and all 1,144 SafeFS tests passed, followed by the full maintained workspace suite. Build, lint, public-consumer checks, and built-public exact-boundary smoke passed. This is logical namespace accounting, not physical storage/RSS. The separate pre-existing absent-file creation case through duplicate mounts is explicitly documented and not claimed fixed. #605's 13 historical source diagnostics remain open. Actual release publication is being monitored separately.

[kamilio]

Release follow-up: both workflows for ed2a6fa succeeded. SafeFS/SafeJS/Safe Bash 0.1.83 actually published (run 33929384845); poe-code 14.0.38 actually published (run 33929385007), and registry gitHead matches the delivered commit. Fresh, integrity-verified 0.1.83 tarballs passed Node/Bun/TypeScript/browser-bundle checks and the public BOM, fragmented-sort/head, and quota-alias regressions. Browser output was exercised under Node, not a deployed browser or live remote provider. Issue closure preceded release monitoring, as requested.