CAS: doc for GC round

docs/en/antalya/cas/architecture/blob-protocol.md

@@ -186,7 +186,7 @@ in RAM at a time. Native object storage streams and can use multipart.
 `.meta` has exactly two states: `Clean` (body present, may be referenced) and `Condemned`
 (`GC` observed zero in-degree; the body is still present and a writer may replace it). An
 *absent* `.meta` reads exactly like `Clean` — there is no third "unaccounted" state in the
-stored format; `unaccounted` is an `ca-fsck` classification, not something `GC` ever writes.
+stored format; `unaccounted` is a `cas-fsck` classification, not something `GC` ever writes.
 
 The record carries `state`, `condemn_round`, and `size`, and deliberately carries **no token**:
 it is a per-hash hint, not a per-incarnation fact. All safety comes from the body's in-envelope

docs/en/antalya/cas/architecture/correctness.md

@@ -48,7 +48,7 @@ replicas against one shared pool under a seeded workload and a seeded fault inje
 idealized model necessarily abstracts away: the dangling-manifest hazard and the condemned-body replacement orphan were
 both first observed live in `system.cas_log` during soak runs, before either got a focused model. Each
 quiesced soak checkpoint cross-checks `SQL` results against a model oracle and runs
-`clickhouse-disks ca-fsck` plus `ca-gc-dryrun`, asserting `dangling=0`.
+`clickhouse-disks cas-fsck` plus `cas-gc-dryrun`, asserting `dangling=0`.
 
 The relationship runs in both directions: the historical resurrect-reupload orphan (`utils/ca-soak` scenario
 S30, root-caused via `system.cas_log`) got a focused `TLA+` reproduction that proved the fix and

docs/en/antalya/cas/architecture/manifests-and-refs.md

@@ -122,7 +122,7 @@ namespace whose view fails to build is added to an errored set with **all** of i
 skipped — an empty owner set is never substituted for a failed one. A body that cannot be opened
 or decoded is likewise retained: it increments both `skipped` and `undecodable`, advances the page
 decision cursor, logs the exact key, and does not prevent later candidates from being examined. It
-is not repaired or deleted, and remains visible to `ca-fsck` as an unreachable object. A decoded
+is not repaired or deleted, and remains visible to `cas-fsck` as an unreachable object. A decoded
 body whose ref or namespace does not match its key instead fails the round with `CORRUPTED_DATA`.
 
 For every legal nomination, the sweep derives exact source-retirement records for the body's blob
@@ -273,7 +273,7 @@ after the durable install. In-flight precommits are visible only through the pre
 through an ordinary ref resolve.
 
 Two cross-process readers see a different, colder view, but only at the discovery boundary: `GC`
-and `ca-fsck` `LIST` once to discover which namespaces exist, staleness-bounded by whatever was
+and `cas-fsck` `LIST` once to discover which namespaces exist, staleness-bounded by whatever was
 durable at `LIST` time, so a namespace born after that `LIST` is invisible to this pass. Within
 each discovered namespace, the replay itself is not `LIST`-driven — it is the same exact-`GET`,
 `_ckpt`-grounded arithmetic walk described above, just called from a caller-supplied catalog entry

docs/en/antalya/cas/architecture/read-path.md

@@ -78,7 +78,7 @@ temporary part is never mistaken for a real, resolvable part.
 
 ## Diagnostic and read-only access {#read-only-access}
 
-A read-only or diagnostic opener of a `CAS` disk (`ca-fsck`, `ca-gc-dryrun`, and similar tools)
+A read-only or diagnostic opener of a `CAS` disk (`cas-fsck`, `cas-gc-dryrun`, and similar tools)
 must not claim mount ownership, schedule `GC`, or mint writer state — read-only enforcement sits
 below the ordinary facade checks, at the backend layer itself. A mounted `Pool` caches its ref
 table and does not re-recover it on every read; a diagnostic tool that deliberately performs a

docs/en/antalya/cas/architecture/replication.md

@@ -120,7 +120,7 @@ log. That ordering, steps T1 then T2 then T3, is the whole seal.
 This does **not** establish that every subsequent `GC` fold *sees* that `+1` under every listing
 behavior: a configuration with one incomplete listing page can, in principle, let a fold miss a
 freshly published edge. A confirmed relink therefore proves only "the source still holds exactly
-this manifest right now", not "no future fold can ever miss this edge" — `ca-fsck`'s
+this manifest right now", not "no future fold can ever miss this edge" — `cas-fsck`'s
 reachable-but-absent scan is the backstop for that gap, not the relink protocol itself. Relink
 also races `GC` in the ordinary sense any writer does: between the sender encoding its offer and
 the receiver's promote, `GC` on the shared pool may condemn a blob that was live only through the

docs/en/antalya/cas/roadmap.md

@@ -48,7 +48,7 @@ capability probe runs at every writable mount and refuses a backend that does no
 conditions CAS depends on.
 
 **Operability.** `system.cas_log`, `system.cas_gc_log`, and `system.cas_mounts` for introspection;
-`clickhouse-disks` commands `ca-fsck`, `ca-inspect`, `ca-gc-dryrun`, and `ca-gc-rebuild`; the
+`clickhouse-disks` commands `cas-fsck`, `cas-inspect`, `cas-gc-dryrun`, and `cas-gc-rebuild`; the
 `SYSTEM CAS` SQL control surface (`GC RUN`/`STOP`/`START`/`REBUILD`, `FSCK`, `FORGET`, `DROP POOL
 MEMBER`).