@dsh-enhanced/lark-channel 0.1.64 → 0.1.66

package/lib/rsi-linux-native-relocation.js

@@ -0,0 +1,1555 @@
+import { createHash } from 'node:crypto';
+import { constants, createReadStream } from 'node:fs';
+import { chmod, lstat, mkdir, open, readdir, readFile, readlink, realpath, symlink } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { hashLinuxRuntimeTree, linuxRuntimeDigest, validateLinuxRuntime, validateLinuxUserNamespaceMapping, } from '@dsh-enhanced/assistant-isolation';
+const PEER_SPECIFIER = '@dsh-enhanced/assistant-verifier/linux-behavior-runtime';
+const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+const HEX = /^[a-f0-9]{64}$/u;
+const COMMIT = /^[a-f0-9]{40}$/u;
+const SEMVER = /^[0-9]+\.[0-9]+\.[0-9]+$/u;
+const MAX_ENTRIES = 500_000;
+const MAX_BYTES = 8 * 1024 ** 3;
+const MAX_RECEIPT_BYTES = 4 * 1024 * 1024;
+const CHUNK = 64 * 1024;
+const ELEMENT_NAMES = ['runtime', 'repository-runtime', 'system', 'behavior-runtime',
+    'release-toolchain', 'release-store', 'release-cache'];
+function fail(message) { throw new Error(`rsi Linux native relocation: ${message}`); }
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const digest = (value) => sha(JSON.stringify(value));
+const stamp = (info) => JSON.stringify([info.dev, info.ino, info.uid, info.mode, info.size,
+    info.mtimeMs, info.ctimeMs]);
+const canonical = (value) => typeof value === 'string' && isAbsolute(value)
+    && value === resolve(value) && value !== '/' && ![...value].some(character => character.charCodeAt(0) < 32);
+const within = (path, root) => path === root || path.startsWith(`${root}/`);
+const natural = (value) => Number.isSafeInteger(value) && value >= 0;
+function object(value, message) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)
+        || Object.getPrototypeOf(value) !== Object.prototype)
+        fail(message);
+    return value;
+}
+function exactKeys(value, keys, message) {
+    if (Object.keys(value).sort().join() !== [...keys].sort().join())
+        fail(message);
+}
+function stringField(value, key, message) {
+    const field = value[key];
+    if (typeof field !== 'string')
+        fail(message);
+    return field;
+}
+function hexField(value, key, message) {
+    const field = stringField(value, key, message);
+    if (!HEX.test(field))
+        fail(message);
+    return field;
+}
+function naturalField(value, key, message) {
+    const field = value[key];
+    if (!natural(field))
+        fail(message);
+    return field;
+}
+function readInt(value, key) {
+    const field = value[key];
+    if (!natural(field))
+        fail('invalid recorded identity');
+    return field;
+}
+/** Keep AbortError identity while prefixing every other rejection. */
+function reject(error, signal, message) {
+    if (signal?.aborted || error.name === 'AbortError')
+        throw error;
+    fail(`${message}: ${error.message}`);
+}
+async function exists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/** Canonical owner-private directory, as the stock readers require it. */
+async function privateDirectory(path, message) {
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()
+        || info.mode & 0o077 || await realpath(path) !== path)
+        fail(message);
+}
+async function syncDirectory(path) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+}
+async function makePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await chmod(path, 0o700);
+    await privateDirectory(path, 'relocation destination is not a private directory');
+}
+/** Every descriptor family records its immutable tree as a nested `root`. */
+function readRoot(descriptor) {
+    const root = object(descriptor.root, 'invalid recorded root');
+    exactKeys(root, ['dev', 'ino', 'path', 'sha256'], 'invalid recorded root');
+    const path = stringField(root, 'path', 'invalid recorded root');
+    if (!canonical(path))
+        fail('invalid recorded root');
+    return root;
+}
+function validateSnapshot(value) {
+    const snapshot = object(value, 'invalid system snapshot');
+    exactKeys(snapshot, ['bytes', 'entries', 'manifestSha256', 'root', 'schemaVersion'], 'invalid system snapshot');
+    if (snapshot.schemaVersion !== 1)
+        fail('invalid system snapshot');
+    hexField(snapshot, 'manifestSha256', 'invalid system snapshot');
+    naturalField(snapshot, 'bytes', 'invalid system snapshot');
+    naturalField(snapshot, 'entries', 'invalid system snapshot');
+    readRoot(snapshot);
+    return snapshot;
+}
+function validateCgroupRoots(value, home) {
+    const roots = object(value, 'invalid cgroup roots');
+    exactKeys(roots, ['cpu', 'freezer', 'memory', 'mode', 'pids'], 'invalid cgroup roots');
+    if (roots.mode !== 'v1')
+        fail('invalid cgroup roots');
+    const owner = process.getuid?.();
+    const seen = new Set();
+    for (const name of ['cpu', 'freezer', 'memory', 'pids']) {
+        const path = stringField(roots, name, 'invalid cgroup roots');
+        if (!canonical(path) || !path.startsWith('/sys/fs/cgroup/') || within(path, home) || seen.has(path)
+            || owner !== undefined && !path.endsWith(`/dsh-native/uid-${owner}`))
+            fail('invalid cgroup roots');
+        seen.add(path);
+    }
+    return roots;
+}
+function validateUserNamespace(value) {
+    try {
+        return object(validateLinuxUserNamespaceMapping(value), 'invalid user namespace');
+    }
+    catch (error) {
+        reject(error, undefined, 'invalid user namespace');
+    }
+}
+function validateBehavior(peer, value) {
+    try {
+        return peer.validateLinuxPluginBehaviorRuntime(value);
+    }
+    catch (error) {
+        reject(error, undefined, 'behavior descriptor differs');
+    }
+}
+function validateRuntime(value) {
+    try {
+        return validateLinuxRuntime(value);
+    }
+    catch (error) {
+        reject(error, undefined, 'runtime descriptor differs');
+    }
+}
+async function hashTree(path, signal, message) {
+    try {
+        return await hashLinuxRuntimeTree(path, signal);
+    }
+    catch (error) {
+        reject(error, signal, message);
+    }
+}
+function behaviorPeer() {
+    const requirePeer = createRequire(import.meta.url);
+    try {
+        requirePeer.resolve(PEER_SPECIFIER);
+    }
+    catch (error) {
+        if (error.code === 'MODULE_NOT_FOUND'
+            || error.code === 'ERR_MODULE_NOT_FOUND') {
+            fail(`Linux native relocation requires installed peer ${PEER_SPECIFIER}`);
+        }
+        throw error;
+    }
+    const peer = requirePeer(PEER_SPECIFIER);
+    if (typeof peer.validateLinuxPluginBehaviorRuntime !== 'function'
+        || typeof peer.linuxPluginBehaviorRuntimeDigest !== 'function') {
+        fail('installed Linux behavior runtime peer is unavailable; update the assistant-verifier peer');
+    }
+    return peer;
+}
+const runtimeRelative = (profile) => `rsi-linux-runtimes/${profile}/runtime`;
+const repositoryRuntimeRelative = (profile) => `rsi-linux-repository-runtimes/${profile}/runtime`;
+const systemRelative = (profile) => `rsi-linux-repository-runtimes/${profile}/system`;
+const behaviorRelative = (profile) => `rsi-authorities/${profile}/state/linux-creation-behavior/runtime`;
+const creationRelative = (profile) => `rsi-linux-creation-builds/${profile}`;
+const releaseRelative = (profile) => `rsi-release-builds/${profile}`;
+const releaseTreeRelative = (profile, name) => `${releaseRelative(profile)}/${name}`;
+const runtimeFamily = (profile) => `rsi-linux-runtimes/${profile}`;
+const repositoryFamily = (profile) => `rsi-linux-repository-runtimes/${profile}`;
+const authorityFamily = (profile) => `rsi-authorities/${profile}`;
+const behaviorFamily = (profile) => `rsi-authorities/${profile}/state/linux-creation-behavior`;
+function under(home, path) { return join(home, ...path.split('/')); }
+function relativeOf(name, profile) {
+    switch (name) {
+        case 'runtime': return runtimeRelative(profile);
+        case 'repository-runtime': return repositoryRuntimeRelative(profile);
+        case 'system': return systemRelative(profile);
+        case 'behavior-runtime': return behaviorRelative(profile);
+        case 'release-toolchain': return releaseTreeRelative(profile, 'toolchain');
+        case 'release-store': return releaseTreeRelative(profile, 'store');
+        case 'release-cache': return releaseTreeRelative(profile, 'cache');
+    }
+}
+function rewrite(value, from, to) {
+    if (value === from)
+        return to;
+    return value.startsWith(`${from}/`) ? `${to}${value.slice(from.length)}` : value;
+}
+/** Rewrite only recorded absolute paths, preserving every key's position. */
+function relocate(value, from, to) {
+    if (typeof value === 'string')
+        return rewrite(value, from, to);
+    if (Array.isArray(value))
+        return value.map(item => relocate(item, from, to));
+    if (value !== null && typeof value === 'object') {
+        const result = {};
+        for (const [key, item] of Object.entries(value))
+            result[key] = relocate(item, from, to);
+        return result;
+    }
+    return value;
+}
+/** Recompute the trailing self-digest without reordering retained fields. */
+function seal(receipt) {
+    const content = {};
+    for (const [key, value] of Object.entries(receipt))
+        if (key !== 'receiptDigest')
+            content[key] = value;
+    return { ...content, receiptDigest: digest(content) };
+}
+function verifyReceiptDigest(receipt, message) {
+    const content = {};
+    for (const [key, value] of Object.entries(receipt))
+        if (key !== 'receiptDigest')
+            content[key] = value;
+    if (!HEX.test(stringField(receipt, 'receiptDigest', message)) || digest(content) !== receipt.receiptDigest) {
+        fail(message);
+    }
+}
+async function readReceipt(path, privateMode) {
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size > MAX_RECEIPT_BYTES
+        || info.uid !== process.getuid?.() || info.mode & 0o022 || privateMode && info.mode & 0o077) {
+        fail('unsafe source receipt');
+    }
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        if (stamp(await fd.stat()) !== stamp(info))
+            fail('source receipt changed');
+        const text = await fd.readFile({ encoding: 'utf8' });
+        if (stamp(await fd.stat()) !== stamp(info) || stamp(await lstat(path)) !== stamp(info)) {
+            fail('source receipt changed');
+        }
+        return parseObject(text, 'invalid source receipt');
+    }
+    finally {
+        await fd.close();
+    }
+}
+function parseObject(text, message) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        fail(message);
+    }
+    return object(parsed, message);
+}
+async function inventory(path, names, message) {
+    let entries;
+    try {
+        entries = await readdir(path);
+    }
+    catch (error) {
+        reject(error, undefined, message);
+    }
+    if (entries.sort().join() !== [...names].sort().join())
+        fail(message);
+}
+async function treeMeta(path, root, signal) {
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()
+        || await realpath(path) !== path)
+        fail('unsafe source tree');
+    if (info.dev !== readInt(root, 'dev') || info.ino !== readInt(root, 'ino'))
+        fail('source tree identity differs');
+    const recorded = stringField(root, 'sha256', 'invalid recorded root');
+    if (!HEX.test(recorded) || await hashTree(path, signal, 'source tree differs') !== recorded) {
+        fail('source tree digest differs');
+    }
+}
+/** The release build pins are sealed content digests produced by the Control
+ * Plane release adapter, which canonicalises keys and sorts directory entries.
+ * Re-deriving them here authenticates the source trees before they are copied
+ * and proves the copy carries exactly the pinned bytes after it. */
+function canonicalReleaseValue(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalReleaseValue).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        return `{${Object.entries(value).filter(([, item]) => item !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, item]) => `${JSON.stringify(key)}:${canonicalReleaseValue(item)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+const RELEASE_PIN_MAX_BYTES = 268_435_456;
+async function releaseInventory(path, signal) {
+    checkAbort(signal);
+    const owner = process.getuid?.();
+    const root = await realpath(path);
+    if (root !== path)
+        fail('source release tree is not canonical');
+    const info = await lstat(path);
+    if (!info.isDirectory() || info.isSymbolicLink() || info.mode & 0o022
+        || owner !== undefined && info.uid !== owner)
+        fail('unsafe source release tree');
+    const entries = [];
+    const visit = async (directory, prefix) => {
+        checkAbort(signal);
+        for (const name of (await readdir(directory)).sort()) {
+            checkAbort(signal);
+            const entryPath = join(directory, name);
+            const entryName = prefix === '' ? name : `${prefix}/${name}`;
+            const entry = await lstat(entryPath);
+            if ((!entry.isSymbolicLink() && entry.mode & 0o022)
+                || owner !== undefined && entry.uid !== owner)
+                fail('unsafe source release tree entry');
+            if (entry.isDirectory()) {
+                entries.push({ path: entryName, type: 'directory', mode: entry.mode & 0o777 });
+                await visit(entryPath, entryName);
+            }
+            else if (entry.isFile()) {
+                if (entry.size > RELEASE_PIN_MAX_BYTES)
+                    fail('source release tree file is oversized');
+                const bytes = await readFile(entryPath);
+                entries.push({ path: entryName, type: 'file', mode: entry.mode & 0o777, bytes: bytes.length,
+                    sha256: sha(bytes) });
+            }
+            else if (entry.isSymbolicLink()) {
+                const target = await readlink(entryPath);
+                if (isAbsolute(target))
+                    fail('source release tree has an absolute symlink');
+                const resolved = resolve(dirname(entryPath), target);
+                if (resolved !== path && !resolved.startsWith(`${path}/`)) {
+                    fail('source release tree has an escaping symlink');
+                }
+                entries.push({ path: entryName, type: 'symlink', target });
+            }
+            else
+                fail('source release tree has an unsupported entry');
+        }
+    };
+    await visit(path, '');
+    return sha(canonicalReleaseValue(entries));
+}
+async function pinnedExecutableDigest(path, signal) {
+    checkAbort(signal);
+    const owner = process.getuid?.();
+    const info = await lstat(path);
+    if (!info.isFile() || info.isSymbolicLink() || info.nlink !== 1 || info.size < 1
+        || info.mode & 0o022 || (info.mode & 0o111) === 0 || owner !== undefined && info.uid !== owner && info.uid !== 0
+        || await realpath(path) !== path)
+        fail('unsafe source release executable');
+    if (info.size > RELEASE_PIN_MAX_BYTES)
+        fail('source release executable is oversized');
+    return sha(await readFile(path));
+}
+function releasePin(value, message) {
+    const item = object(value, message);
+    exactKeys(item, ['path', 'sha256'], message);
+    const path = stringField(item, 'path', message);
+    if (!canonical(path))
+        fail(message);
+    return { path, sha256: hexField(item, 'sha256', message) };
+}
+const RELEASE_PIN_KEYS = ['cacheRoot', 'nodeExecutable', 'pnpmExecutable', 'pnpmRoot', 'sandboxExecutable',
+    'storeRoot', 'tarExecutable'];
+/** Validate the recorded pin layout against one Home without reading its trees. */
+function releaseLayout(receipt, home, profile) {
+    const build = object(receipt.releaseBuild, 'source release receipt differs');
+    exactKeys(build, RELEASE_PIN_KEYS, 'source release receipt differs');
+    const pins = {
+        sandboxExecutable: releasePin(build.sandboxExecutable, 'source release receipt differs'),
+        tarExecutable: releasePin(build.tarExecutable, 'source release receipt differs'),
+        nodeExecutable: releasePin(build.nodeExecutable, 'source release receipt differs'),
+        pnpmExecutable: releasePin(build.pnpmExecutable, 'source release receipt differs'),
+        pnpmRoot: releasePin(build.pnpmRoot, 'source release receipt differs'),
+        storeRoot: releasePin(build.storeRoot, 'source release receipt differs'),
+        cacheRoot: releasePin(build.cacheRoot, 'source release receipt differs'),
+    };
+    if (pins.sandboxExecutable.path !== '/usr/bin/bwrap' || pins.tarExecutable.path !== '/usr/bin/tar'
+        || pins.pnpmRoot.path !== under(home, releaseTreeRelative(profile, 'toolchain'))
+        || pins.storeRoot.path !== under(home, releaseTreeRelative(profile, 'store'))
+        || pins.cacheRoot.path !== under(home, releaseTreeRelative(profile, 'cache'))
+        || pins.nodeExecutable.path !== join(pins.pnpmRoot.path, 'node')
+        || pins.pnpmExecutable.path !== join(pins.pnpmRoot.path, 'pnpm')) {
+        fail('source release receipt differs');
+    }
+    return pins;
+}
+/** Re-derive every pin from the trees that are about to be copied. */
+async function releasePins(pins, signal) {
+    for (const [label, item, kind] of [
+        ['sandbox', pins.sandboxExecutable, 'executable'],
+        ['tar', pins.tarExecutable, 'executable'],
+        ['node', pins.nodeExecutable, 'executable'],
+        ['pnpm', pins.pnpmExecutable, 'executable'],
+        ['pnpm root', pins.pnpmRoot, 'tree'],
+        ['pnpm store', pins.storeRoot, 'tree'],
+        ['pnpm cache', pins.cacheRoot, 'tree'],
+    ]) {
+        const computed = kind === 'executable'
+            ? await pinnedExecutableDigest(item.path, signal)
+            : await releaseInventory(item.path, signal);
+        if (computed !== item.sha256)
+            fail(`source release ${label} differs`);
+    }
+    // The stock release readers re-check these two semantics after the cutover.
+    const manifest = JSON.parse(await readFile(join(pins.pnpmRoot.path, 'package.json'), 'utf8'));
+    const version = stringField(manifest, 'version', 'source release pnpm manifest differs');
+    if (!SEMVER.test(version))
+        fail('source release pnpm manifest differs');
+    const storeVersion = Number.parseInt(version, 10);
+    const projects = join(pins.storeRoot.path, `v${storeVersion}`, 'projects');
+    const projectsInfo = await lstat(projects).catch(() => undefined);
+    if (projectsInfo === undefined || !projectsInfo.isDirectory() || projectsInfo.isSymbolicLink()) {
+        fail('source release pnpm store registry differs');
+    }
+}
+async function authenticateBaseRuntime(home, profile, signal, physicalHome = home) {
+    const runtimePath = under(physicalHome, runtimeRelative(profile));
+    // The schema-3 bootstrap receipt binds the immutable Node/pnpm toolchain.
+    const runtimeReceipt = await readReceipt(join(under(physicalHome, runtimeFamily(profile)), 'bootstrap.json'), true);
+    exactKeys(runtimeReceipt, ['archives', 'backend', 'dshHome', 'lockSha256', 'manifestHashes', 'profile',
+        'receiptDigest', 'runtime', 'schemaVersion', 'sourceCommit'], 'source runtime receipt differs');
+    verifyReceiptDigest(runtimeReceipt, 'source runtime receipt digest differs');
+    if (runtimeReceipt.schemaVersion !== 3 || runtimeReceipt.backend !== 'linux-native'
+        || runtimeReceipt.dshHome !== home || runtimeReceipt.profile !== profile)
+        fail('source runtime receipt differs');
+    const sourceCommit = stringField(runtimeReceipt, 'sourceCommit', 'source runtime receipt differs');
+    if (!COMMIT.test(sourceCommit))
+        fail('source runtime receipt differs');
+    const lockSha256 = hexField(runtimeReceipt, 'lockSha256', 'source runtime receipt differs');
+    const runtime = validateRuntime(runtimeReceipt.runtime);
+    if (runtime.root.path !== under(home, runtimeRelative(profile)) || runtime.sourceCommit !== sourceCommit || runtime.lockSha256 !== lockSha256) {
+        fail('source runtime receipt differs');
+    }
+    const manifests = object(runtimeReceipt.manifestHashes, 'source runtime receipt differs');
+    if (Object.keys(manifests).length === 0
+        || Object.values(manifests).some(value => typeof value !== 'string' || !HEX.test(value))) {
+        fail('source runtime receipt differs');
+    }
+    const archives = object(runtimeReceipt.archives, 'source runtime receipt differs');
+    exactKeys(archives, ['node', 'pnpm', 'pnpmExe', 'pnpmNative'], 'source runtime receipt differs');
+    for (const key of ['node', 'pnpm', 'pnpmExe', 'pnpmNative'])
+        hexField(archives, key, 'source runtime receipt differs');
+    await treeMeta(runtimePath, readRoot(runtime), signal);
+    return { runtime, runtimeReceipt, sourceCommit, lockSha256 };
+}
+async function authenticateReleaseSource(home, profile, runtime, sourceCommit, signal, physicalHome = home) {
+    // The release build pins the fixed toolchain/store/cache trees that the
+    // native runner executes with; its receipt must describe this exact Home and
+    // the base runtime this Home was prepared from.
+    await inventory(under(physicalHome, releaseRelative(profile)), ['bootstrap.json', 'cache', 'store', 'toolchain'], 'source release family differs');
+    const releaseReceipt = await readReceipt(join(under(physicalHome, releaseRelative(profile)), 'bootstrap.json'), true);
+    exactKeys(releaseReceipt, ['backend', 'dshHome', 'profile', 'receiptDigest', 'releaseBuild', 'runtimeDigest',
+        'schemaVersion', 'sourceCommit'], 'source release receipt differs');
+    verifyReceiptDigest(releaseReceipt, 'source release receipt digest differs');
+    const baseRuntimeDigest = linuxRuntimeDigest(runtime);
+    if (releaseReceipt.schemaVersion !== 2 || releaseReceipt.backend !== 'linux-native'
+        || releaseReceipt.dshHome !== home || releaseReceipt.profile !== profile
+        || releaseReceipt.sourceCommit !== sourceCommit || releaseReceipt.runtimeDigest !== baseRuntimeDigest) {
+        fail('source release receipt differs');
+    }
+    const release = releaseLayout(releaseReceipt, home, profile);
+    await releasePins(relocate(release, home, physicalHome), signal);
+    return releaseReceipt;
+}
+async function authenticateSource(home, profile, peer, signal) {
+    const repositoryPath = under(home, repositoryRuntimeRelative(profile));
+    const systemPath = under(home, systemRelative(profile));
+    const behaviorPath = under(home, behaviorRelative(profile));
+    const creationPath = under(home, creationRelative(profile));
+    await inventory(under(home, runtimeFamily(profile)), ['bootstrap.json', 'runtime'], 'source runtime family differs');
+    await inventory(under(home, repositoryFamily(profile)), ['bootstrap.json', 'runtime', 'system'], 'source repository family differs');
+    await inventory(under(home, behaviorFamily(profile)), ['behavior.json', 'runtime'], 'source behavior family differs');
+    await inventory(creationPath, ['bootstrap.json'], 'source creation family differs');
+    const { runtime, runtimeReceipt, sourceCommit, lockSha256 } = await authenticateBaseRuntime(home, profile, signal);
+    // The schema-4 repository receipt binds the base runtime, system snapshot and
+    // user namespace; only its path-bearing parts are relocated.
+    const repositoryReceipt = await readReceipt(join(under(home, repositoryFamily(profile)), 'bootstrap.json'), true);
+    exactKeys(repositoryReceipt, ['backend', 'baseRuntimeDigest', 'dshHome', 'lockSha256', 'nodeArchiveDigest',
+        'npmVersion', 'ownerGid', 'ownerUid', 'profile', 'receiptDigest', 'runtime', 'runtimeDigest', 'schemaVersion',
+        'sourceCommit', 'sourceDigest', 'systemSnapshot', 'systemSnapshotDigest', 'userNamespace',
+        'userNamespaceDigest'], 'source repository receipt differs');
+    verifyReceiptDigest(repositoryReceipt, 'source repository receipt digest differs');
+    const repository = validateRuntime(repositoryReceipt.runtime);
+    const snapshot = validateSnapshot(repositoryReceipt.systemSnapshot);
+    const userNamespace = validateUserNamespace(repositoryReceipt.userNamespace);
+    const uid = process.getuid?.(), gid = process.getgid?.();
+    const sourceDigest = hexField(repositoryReceipt, 'sourceDigest', 'source repository receipt differs');
+    const nodeArchiveDigest = hexField(repositoryReceipt, 'nodeArchiveDigest', 'source repository receipt differs');
+    const npmVersion = stringField(repositoryReceipt, 'npmVersion', 'source repository receipt differs');
+    if (repositoryReceipt.schemaVersion !== 4 || repositoryReceipt.backend !== 'linux-native'
+        || repositoryReceipt.dshHome !== home || repositoryReceipt.profile !== profile
+        || repositoryReceipt.ownerUid !== uid || repositoryReceipt.ownerGid !== gid
+        || repositoryReceipt.sourceCommit !== sourceCommit || repositoryReceipt.lockSha256 !== lockSha256
+        || !SEMVER.test(npmVersion) || !HEX.test(sourceDigest) || !HEX.test(nodeArchiveDigest)
+        || repositoryReceipt.baseRuntimeDigest !== digest(runtimeReceipt.runtime)
+        || repositoryReceipt.runtimeDigest !== digest(repositoryReceipt.runtime)
+        || repositoryReceipt.systemSnapshotDigest !== digest(repositoryReceipt.systemSnapshot)
+        || repositoryReceipt.userNamespaceDigest !== digest(repositoryReceipt.userNamespace)
+        || repository.root.path !== repositoryPath || repository.sourceCommit !== sourceCommit
+        || repository.lockSha256 !== lockSha256
+        || readRoot(snapshot).path !== systemPath)
+        fail('source repository receipt differs');
+    await treeMeta(repositoryPath, readRoot(repository), signal);
+    await treeMeta(systemPath, readRoot(snapshot), signal);
+    // The behavior deployment receipt is the immutable authority for the plugin
+    // observer; its digest is also the creation receipt's preparation digest.
+    const behaviorReceipt = await readReceipt(join(under(home, behaviorFamily(profile)), 'behavior.json'), false);
+    exactKeys(behaviorReceipt, ['baseRuntimeDigest', 'compilerSha256', 'descriptor', 'receiptDigest', 'schemaVersion'], 'source behavior receipt differs');
+    verifyReceiptDigest(behaviorReceipt, 'source behavior receipt digest differs');
+    if (behaviorReceipt.schemaVersion !== 1
+        || behaviorReceipt.baseRuntimeDigest !== linuxRuntimeDigest(repository)
+        || !HEX.test(stringField(behaviorReceipt, 'compilerSha256', 'source behavior receipt differs'))) {
+        fail('source behavior receipt differs');
+    }
+    const behavior = validateBehavior(peer, behaviorReceipt.descriptor);
+    if (behavior.runtime.root.path !== behaviorPath)
+        fail('source behavior receipt differs');
+    await treeMeta(behaviorPath, readRoot(behavior.runtime), signal);
+    // The creation receipt aggregates the other three and carries cgroup roots
+    // that must already live outside the source Home.
+    const creationReceipt = await readReceipt(join(creationPath, 'bootstrap.json'), true);
+    exactKeys(creationReceipt, ['backend', 'behavior', 'behaviorDigest', 'buildRuntimeDigest', 'cgroupRoots',
+        'dshHome', 'lockSha256', 'preparationDigest', 'profile', 'repositoryRuntimeDigest', 'schemaVersion',
+        'sourceCommit', 'systemSnapshotDigest', 'userNamespaceDigest', 'receiptDigest'], 'source creation receipt differs');
+    verifyReceiptDigest(creationReceipt, 'source creation receipt digest differs');
+    validateCgroupRoots(creationReceipt.cgroupRoots, home);
+    const repositoryRuntimeDigest = linuxRuntimeDigest(repository);
+    if (creationReceipt.schemaVersion !== 3 || creationReceipt.backend !== 'linux-native'
+        || creationReceipt.dshHome !== home || creationReceipt.profile !== profile
+        || creationReceipt.sourceCommit !== sourceCommit || creationReceipt.lockSha256 !== lockSha256
+        || creationReceipt.buildRuntimeDigest !== repositoryRuntimeDigest
+        || creationReceipt.repositoryRuntimeDigest !== repositoryRuntimeDigest
+        || creationReceipt.preparationDigest !== behaviorReceipt.receiptDigest
+        || creationReceipt.behaviorDigest !== peer.linuxPluginBehaviorRuntimeDigest(behavior)
+        || creationReceipt.systemSnapshotDigest !== digest(repositoryReceipt.systemSnapshot)
+        || creationReceipt.userNamespaceDigest !== digest(repositoryReceipt.userNamespace)
+        || !isDeepStrictEqual(creationReceipt.behavior, behaviorReceipt.descriptor)) {
+        fail('source creation receipt differs');
+    }
+    const releaseReceipt = await authenticateReleaseSource(home, profile, runtime, sourceCommit, signal);
+    return {
+        runtime, runtimeReceipt, repository, repositoryReceipt, snapshot, userNamespace,
+        behavior, behaviorReceipt, creationReceipt, releaseReceipt,
+    };
+}
+function checkAbort(signal) { signal?.throwIfAborted(); }
+async function writeAll(fd, buffer, signal) {
+    let offset = 0;
+    while (offset < buffer.length) {
+        checkAbort(signal);
+        const written = await fd.write(buffer, offset, buffer.length - offset);
+        if (written.bytesWritten <= 0)
+            fail('copy write stalled');
+        offset += written.bytesWritten;
+    }
+}
+async function copyFile(source, destination, before, budget, signal) {
+    budget.entries += 1;
+    budget.bytes += before.size;
+    if (budget.entries > MAX_ENTRIES)
+        fail('source tree entry bound exceeded');
+    if (budget.bytes > MAX_BYTES)
+        fail('source tree byte bound exceeded');
+    if (before.nlink !== 1 || before.mode & 0o022)
+        fail('unsafe source tree file');
+    const input = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+    let output;
+    try {
+        if (stamp(await input.stat()) !== stamp(before))
+            fail('source tree changed during copy');
+        output = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        let copied = 0;
+        const stream = createReadStream(source, signal
+            ? { fd: input.fd, autoClose: false, highWaterMark: CHUNK, signal }
+            : { fd: input.fd, autoClose: false, highWaterMark: CHUNK });
+        for await (const chunk of stream) {
+            checkAbort(signal);
+            const buffer = chunk;
+            copied += buffer.length;
+            if (copied > before.size)
+                fail('source tree file grew during copy');
+            await writeAll(output, buffer, signal);
+        }
+        if (copied !== before.size)
+            fail('source tree file changed during copy');
+        await output.sync();
+        await output.chmod(before.mode & 0o777);
+        if (stamp(await input.stat()) !== stamp(before) || stamp(await lstat(source)) !== stamp(before)) {
+            fail('source tree changed during copy');
+        }
+    }
+    finally {
+        await output?.close();
+        await input.close();
+    }
+}
+async function copyDirectory(source, destination, before, root, budget, signal) {
+    budget.entries += 1;
+    if (budget.entries > MAX_ENTRIES)
+        fail('source tree entry bound exceeded');
+    if (before.mode & 0o022)
+        fail('unsafe source tree directory');
+    await mkdir(destination, { mode: 0o700 });
+    const names = (await readdir(source)).sort();
+    for (const name of names) {
+        checkAbort(signal);
+        await copyEntry(join(source, name), join(destination, name), root, budget, signal);
+    }
+    await chmod(destination, before.mode & 0o777);
+    await syncDirectory(destination);
+    if (stamp(await lstat(source)) !== stamp(before))
+        fail('source tree changed during copy');
+}
+async function copyLink(source, destination, root, budget) {
+    budget.entries += 1;
+    if (budget.entries > MAX_ENTRIES)
+        fail('source tree entry bound exceeded');
+    const target = await readlink(source);
+    if (isAbsolute(target) || !within(resolve(dirname(source), target), root)
+        || !within(await realpath(source), root))
+        fail('source tree link escaped root');
+    await symlink(target, destination);
+}
+async function copyEntry(source, destination, root, budget, signal) {
+    checkAbort(signal);
+    const before = await lstat(source);
+    if (before.uid !== process.getuid?.())
+        fail('foreign-owned source tree entry');
+    if (before.isSymbolicLink()) {
+        await copyLink(source, destination, root, budget);
+    }
+    else if (before.isDirectory()) {
+        await copyDirectory(source, destination, before, root, budget, signal);
+    }
+    else if (before.isFile()) {
+        await copyFile(source, destination, before, budget, signal);
+    }
+    else
+        fail('unsupported source tree entry');
+}
+async function copyTree(source, destination, signal, expectedSha256) {
+    const root = await lstat(source);
+    if (!root.isDirectory() || root.isSymbolicLink() || root.uid !== process.getuid?.()
+        || await realpath(source) !== source)
+        fail('unsafe source tree');
+    const budget = { entries: 0, bytes: 0 };
+    await copyDirectory(source, destination, root, source, budget, signal);
+    const copied = await lstat(destination);
+    const copiedSha256 = await hashTree(destination, signal, 'copied tree differs');
+    if (expectedSha256 !== undefined && copiedSha256 !== expectedSha256)
+        fail('copied tree digest differs');
+    return { path: destination, dev: copied.dev, ino: copied.ino, sha256: copiedSha256, ...budget };
+}
+/** Re-seal the release receipt against the copied trees: pins only move, the
+ * runtime digest now binds the relocated base runtime. */
+function relocatedReleaseReceipt(source, sourceHome, logicalHome, baseDigest) {
+    const receipt = object(relocate(source, sourceHome, logicalHome), 'invalid relocated release receipt');
+    const build = object(receipt.releaseBuild, 'invalid relocated release receipt');
+    exactKeys(build, RELEASE_PIN_KEYS, 'invalid relocated release receipt');
+    for (const key of RELEASE_PIN_KEYS) {
+        const pin = releasePin(build[key], 'invalid relocated release receipt');
+        build[key] = pin;
+    }
+    receipt.runtimeDigest = baseDigest;
+    receipt.dshHome = logicalHome;
+    return seal(receipt);
+}
+function setRoot(root, meta) {
+    root.dev = meta.dev;
+    root.ino = meta.ino;
+    root.sha256 = meta.sha256;
+}
+function rewriteRuntime(receipt, meta, path) {
+    const runtime = object(receipt.runtime, 'relocated runtime differs');
+    const root = readRoot(runtime);
+    root.path = path;
+    setRoot(root, meta);
+    validateRuntime(runtime);
+}
+async function writeReceipt(path, receipt) {
+    const fds = Buffer.from(JSON.stringify(receipt));
+    const fd = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+    try {
+        await fd.writeFile(fds);
+        await fd.chmod(0o600);
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+    await syncDirectory(dirname(path));
+}
+function relocatedRuntimeReceipt(source, sourceHome, logicalHome, meta, runtimePath) {
+    const receipt = object(relocate(source, sourceHome, logicalHome), 'invalid relocated runtime receipt');
+    rewriteRuntime(receipt, meta, runtimePath);
+    return seal(receipt);
+}
+function relocatedRepositoryReceipt(source, sourceHome, logicalHome, runtimeMeta, systemMeta, runtimePath, systemPath, base) {
+    const receipt = object(relocate(source, sourceHome, logicalHome), 'invalid relocated repository receipt');
+    rewriteRuntime(receipt, runtimeMeta, runtimePath);
+    const snapshot = validateSnapshot(receipt.systemSnapshot);
+    const root = readRoot(snapshot);
+    root.path = systemPath;
+    setRoot(root, systemMeta);
+    const repositoryRuntime = object(receipt.runtime, 'invalid relocated repository runtime');
+    validateRuntime(repositoryRuntime);
+    receipt.baseRuntimeDigest = digest(base);
+    receipt.runtimeDigest = digest(repositoryRuntime);
+    receipt.systemSnapshotDigest = digest(receipt.systemSnapshot);
+    receipt.userNamespaceDigest = digest(receipt.userNamespace);
+    return seal(receipt);
+}
+function relocatedBehaviorReceipt(source, sourceHome, logicalHome, meta, runtimePath, baseDigest, peer) {
+    const receipt = object(relocate(source, sourceHome, logicalHome), 'invalid relocated behavior receipt');
+    const descriptor = object(receipt.descriptor, 'invalid relocated behavior descriptor');
+    rewriteRuntime(descriptor, meta, runtimePath);
+    validateBehavior(peer, descriptor);
+    receipt.baseRuntimeDigest = baseDigest;
+    return seal(receipt);
+}
+function relocatedCreationReceipt(source, sourceHome, logicalHome, behavior, values) {
+    const receipt = object(relocate(source, sourceHome, logicalHome), 'invalid relocated creation receipt');
+    // Embed the relocated behavior descriptor so the recorded identity and the digest agree.
+    receipt.behavior = behavior;
+    receipt.buildRuntimeDigest = values.repositoryRuntimeDigest;
+    receipt.repositoryRuntimeDigest = values.repositoryRuntimeDigest;
+    receipt.preparationDigest = values.preparationDigest;
+    receipt.behaviorDigest = values.behaviorDigest;
+    receipt.systemSnapshotDigest = values.systemSnapshotDigest;
+    receipt.userNamespaceDigest = values.userNamespaceDigest;
+    return seal(receipt);
+}
+function pureIdentity(input) {
+    const { sourceHome, physicalHome, logicalHome } = input;
+    for (const [name, value] of [['sourceHome', sourceHome], ['physicalHome', physicalHome],
+        ['logicalHome', logicalHome]]) {
+        if (!canonical(value))
+            fail(`invalid ${name}`);
+    }
+    if (input.existingLogicalHome !== undefined) {
+        if (!canonical(input.existingLogicalHome))
+            fail('invalid existingLogicalHome');
+        if (input.existingLogicalHome !== logicalHome)
+            fail('existing logical Home is not this logical Home');
+    }
+    if (!PROFILE.test(input.profile))
+        fail('invalid profile');
+    if (physicalHome === sourceHome || physicalHome === logicalHome || logicalHome === sourceHome) {
+        fail('relocation homes overlap');
+    }
+    if (within(physicalHome, sourceHome) || within(sourceHome, physicalHome)
+        || within(logicalHome, sourceHome) || within(sourceHome, logicalHome)
+        || within(physicalHome, logicalHome) || within(logicalHome, physicalHome))
+        fail('relocation homes overlap');
+}
+/** Substitute for the `logical Home already exists` refusal when the caller
+ * attests this is the live Home being cut over: the path must exist and be its
+ * own realpath, so a dangling path or a symlink to another Home still fails. */
+async function attestedLogicalHome(logicalHome) {
+    if (!(await exists(logicalHome)))
+        fail('existing logical Home is missing');
+    if (await realpath(logicalHome) !== logicalHome)
+        fail('existing logical Home is not canonical');
+}
+/** A fresh physical Home must hold none of the families. An in-place stage of
+ * the live Home (`inPlace`) already carries the owner's authority state, which
+ * the relocation must keep: there only the behavior family it writes inside the
+ * authority must be absent, and the authority directories it descends through
+ * must already be private. */
+async function assertTargetsAbsent(physicalHome, profile, inPlace) {
+    const authority = inPlace ? behaviorFamily(profile) : authorityFamily(profile);
+    for (const path of [runtimeFamily(profile), repositoryFamily(profile), authority,
+        creationRelative(profile), releaseRelative(profile)]) {
+        if (await exists(under(physicalHome, path)))
+            fail('relocation target already exists');
+    }
+    if (!inPlace)
+        return;
+    for (const path of [authorityFamily(profile), `${authorityFamily(profile)}/state`]) {
+        const location = under(physicalHome, path);
+        if (await exists(location))
+            await privateDirectory(location, 'unsafe existing authority directory');
+    }
+}
+function relocationContent(proof) {
+    return {
+        schemaVersion: proof.schemaVersion,
+        backend: proof.backend,
+        profile: proof.profile,
+        sourceHome: proof.sourceHome,
+        physicalHome: proof.physicalHome,
+        logicalHome: proof.logicalHome,
+        behaviorRootRelative: proof.behaviorRootRelative,
+        elements: proof.elements.map(item => ({
+            name: item.name, logicalPath: item.logicalPath, physicalPath: item.physicalPath, dev: item.dev,
+            ino: item.ino, sha256: item.sha256, entries: item.entries, bytes: item.bytes,
+        })),
+        digests: {
+            runtime: proof.digests.runtime,
+            repository: proof.digests.repository,
+            behavior: proof.digests.behavior,
+            creation: proof.digests.creation,
+            release: proof.digests.release,
+        },
+    };
+}
+function relocationDigest(proof) {
+    return digest(relocationContent(proof));
+}
+/** Relocate one prepared Linux-native DSH Home onto a fresh physical Home.
+ * The source is authenticated before copying and never modified. An
+ * `existingLogicalHome` attestation only replaces the "logical Home already
+ * exists" refusal; every other check and the proof shape stay the same. */
+export async function relocateLinuxRsiNativeFamily(input) {
+    pureIdentity(input);
+    const { sourceHome, physicalHome, logicalHome, profile, signal } = input;
+    if (process.platform !== 'linux')
+        fail('Linux native relocation requires Linux');
+    signal?.throwIfAborted();
+    await privateDirectory(sourceHome, 'unsafe source Home');
+    if (input.existingLogicalHome === undefined) {
+        if (await exists(logicalHome))
+            fail('logical Home already exists');
+    }
+    else
+        await attestedLogicalHome(logicalHome);
+    if (await exists(physicalHome))
+        await privateDirectory(physicalHome, 'unsafe physical Home');
+    else
+        await makePrivateDirectory(physicalHome);
+    await assertTargetsAbsent(physicalHome, profile, input.existingLogicalHome !== undefined);
+    const peer = behaviorPeer();
+    const source = await authenticateSource(sourceHome, profile, peer, signal);
+    checkAbort(signal);
+    const runtimePath = under(physicalHome, runtimeRelative(profile));
+    const repositoryPath = under(physicalHome, repositoryRuntimeRelative(profile));
+    const systemPath = under(physicalHome, systemRelative(profile));
+    const behaviorPath = under(physicalHome, behaviorRelative(profile));
+    const logicalRuntimePath = under(logicalHome, runtimeRelative(profile));
+    const logicalRepositoryPath = under(logicalHome, repositoryRuntimeRelative(profile));
+    const logicalSystemPath = under(logicalHome, systemRelative(profile));
+    const logicalBehaviorPath = under(logicalHome, behaviorRelative(profile));
+    const releaseFamilyPath = under(physicalHome, releaseRelative(profile));
+    const releasePaths = {
+        toolchain: under(physicalHome, releaseTreeRelative(profile, 'toolchain')),
+        store: under(physicalHome, releaseTreeRelative(profile, 'store')),
+        cache: under(physicalHome, releaseTreeRelative(profile, 'cache')),
+    };
+    const logicalReleasePaths = {
+        toolchain: under(logicalHome, releaseTreeRelative(profile, 'toolchain')),
+        store: under(logicalHome, releaseTreeRelative(profile, 'store')),
+        cache: under(logicalHome, releaseTreeRelative(profile, 'cache')),
+    };
+    await makePrivateDirectory(under(physicalHome, runtimeFamily(profile)));
+    await makePrivateDirectory(under(physicalHome, repositoryFamily(profile)));
+    await makePrivateDirectory(under(physicalHome, behaviorFamily(profile)));
+    await makePrivateDirectory(under(physicalHome, creationRelative(profile)));
+    await makePrivateDirectory(releaseFamilyPath);
+    const runtimeCopy = await copyTree(source.runtime.root.path, runtimePath, signal, source.runtime.root.sha256);
+    checkAbort(signal);
+    const repositoryCopy = await copyTree(source.repository.root.path, repositoryPath, signal, source.repository.root.sha256);
+    checkAbort(signal);
+    const systemRoot = readRoot(source.snapshot);
+    const systemCopy = await copyTree(systemRoot.path, systemPath, signal, stringField(systemRoot, 'sha256', 'invalid recorded root'));
+    checkAbort(signal);
+    const behaviorCopy = await copyTree(source.behavior.runtime.root.path, behaviorPath, signal, source.behavior.runtime.root.sha256);
+    checkAbort(signal);
+    // The release trees are sealed by the Control Plane's canonical inventory
+    // digest, not by the runtime tree digest: copy them and immediately prove the
+    // copy against the authenticated pins.
+    const sourcePin = releaseLayout(source.releaseReceipt, sourceHome, profile);
+    const releaseCopies = {
+        toolchain: await copyTree(sourcePin.pnpmRoot.path, releasePaths.toolchain, signal),
+        store: await copyTree(sourcePin.storeRoot.path, releasePaths.store, signal),
+        cache: await copyTree(sourcePin.cacheRoot.path, releasePaths.cache, signal),
+    };
+    checkAbort(signal);
+    for (const [label, copy, pin] of [
+        ['toolchain', releaseCopies.toolchain, sourcePin.pnpmRoot],
+        ['store', releaseCopies.store, sourcePin.storeRoot],
+        ['cache', releaseCopies.cache, sourcePin.cacheRoot],
+    ]) {
+        if (await releaseInventory(copy.path, signal) !== pin.sha256) {
+            fail(`copied release ${label} differs`);
+        }
+    }
+    for (const [label, copy, pin] of [
+        ['node', join(releaseCopies.toolchain.path, 'node'), sourcePin.nodeExecutable],
+        ['pnpm', join(releaseCopies.toolchain.path, 'pnpm'), sourcePin.pnpmExecutable],
+    ]) {
+        if (await pinnedExecutableDigest(copy, signal) !== pin.sha256)
+            fail(`copied release ${label} differs`);
+    }
+    checkAbort(signal);
+    const runtimeReceipt = relocatedRuntimeReceipt(source.runtimeReceipt, sourceHome, logicalHome, runtimeCopy, logicalRuntimePath);
+    const repositoryReceipt = relocatedRepositoryReceipt(source.repositoryReceipt, sourceHome, logicalHome, repositoryCopy, systemCopy, logicalRepositoryPath, logicalSystemPath, object(runtimeReceipt.runtime, 'invalid relocated runtime receipt'));
+    // The creation build and the behavior receipt must bind the relocated
+    // repository runtime, never the authenticated source one: the copy has a new
+    // root path/dev/ino, so only this digest can be re-derived by the readers
+    // after the same-filesystem rename cutover.
+    const repositoryRuntimeDigest = linuxRuntimeDigest(validateRuntime(object(repositoryReceipt.runtime, 'invalid relocated repository runtime')));
+    const behaviorReceipt = relocatedBehaviorReceipt(source.behaviorReceipt, sourceHome, logicalHome, behaviorCopy, logicalBehaviorPath, repositoryRuntimeDigest, peer);
+    const behaviorDigest = peer.linuxPluginBehaviorRuntimeDigest(validateBehavior(peer, object(behaviorReceipt.descriptor, 'invalid relocated behavior descriptor')));
+    const creationReceipt = relocatedCreationReceipt(source.creationReceipt, sourceHome, logicalHome, object(behaviorReceipt.descriptor, 'invalid relocated behavior descriptor'), {
+        repositoryRuntimeDigest,
+        preparationDigest: stringField(behaviorReceipt, 'receiptDigest', 'invalid relocated behavior receipt'),
+        behaviorDigest,
+        systemSnapshotDigest: digest(repositoryReceipt.systemSnapshot),
+        userNamespaceDigest: digest(repositoryReceipt.userNamespace),
+    });
+    const elements = [
+        element('runtime', logicalRuntimePath, runtimeCopy),
+        element('repository-runtime', logicalRepositoryPath, repositoryCopy),
+        element('system', logicalSystemPath, systemCopy),
+        element('behavior-runtime', logicalBehaviorPath, behaviorCopy),
+        element('release-toolchain', logicalReleasePaths.toolchain, releaseCopies.toolchain),
+        element('release-store', logicalReleasePaths.store, releaseCopies.store),
+        element('release-cache', logicalReleasePaths.cache, releaseCopies.cache),
+    ];
+    // The release receipt must bind the relocated base runtime while keeping the
+    // logical Home paths the post-cutover stock readers re-derive.
+    const releaseReceipt = relocatedReleaseReceipt(source.releaseReceipt, sourceHome, logicalHome, linuxRuntimeDigest(validateRuntime(object(runtimeReceipt.runtime, 'invalid relocated runtime receipt'))));
+    if (releaseLayout(releaseReceipt, logicalHome, profile).pnpmRoot.path !== logicalReleasePaths.toolchain) {
+        fail('relocated release receipt differs');
+    }
+    const digests = {
+        runtime: stringField(runtimeReceipt, 'receiptDigest', 'invalid relocated runtime receipt'),
+        repository: stringField(repositoryReceipt, 'receiptDigest', 'invalid relocated repository receipt'),
+        behavior: stringField(behaviorReceipt, 'receiptDigest', 'invalid relocated behavior receipt'),
+        creation: stringField(creationReceipt, 'receiptDigest', 'invalid relocated creation receipt'),
+        release: stringField(releaseReceipt, 'receiptDigest', 'invalid relocated release receipt'),
+    };
+    await writeReceipt(join(under(physicalHome, runtimeFamily(profile)), 'bootstrap.json'), runtimeReceipt);
+    await writeReceipt(join(under(physicalHome, repositoryFamily(profile)), 'bootstrap.json'), repositoryReceipt);
+    await writeReceipt(join(under(physicalHome, behaviorFamily(profile)), 'behavior.json'), behaviorReceipt);
+    await writeReceipt(join(physicalHome, creationRelative(profile), 'bootstrap.json'), creationReceipt);
+    await writeReceipt(join(releaseFamilyPath, 'bootstrap.json'), releaseReceipt);
+    const proof = {
+        schemaVersion: 1,
+        backend: 'linux-native',
+        profile,
+        sourceHome,
+        physicalHome,
+        logicalHome,
+        behaviorRootRelative: behaviorRelative(profile),
+        elements,
+        digests: { ...digests, relocation: '' },
+    };
+    proof.digests.relocation = relocationDigest(proof);
+    return proof;
+}
+function element(name, logicalPath, copy) {
+    return {
+        name, logicalPath, physicalPath: copy.path, dev: copy.dev, ino: copy.ino, sha256: copy.sha256,
+        entries: copy.entries, bytes: copy.bytes,
+    };
+}
+function proofShape(proof) {
+    const record = object(proof, 'invalid relocation proof');
+    exactKeys(record, ['backend', 'behaviorRootRelative', 'digests', 'elements', 'logicalHome', 'physicalHome',
+        'profile', 'schemaVersion', 'sourceHome'], 'invalid relocation proof');
+    if (record.schemaVersion !== 1 || record.backend !== 'linux-native')
+        fail('invalid relocation proof');
+    const profile = stringField(record, 'profile', 'invalid relocation proof');
+    if (!PROFILE.test(profile))
+        fail('invalid relocation proof');
+    const sourceHome = stringField(record, 'sourceHome', 'invalid relocation proof');
+    const physicalHome = stringField(record, 'physicalHome', 'invalid relocation proof');
+    const logicalHome = stringField(record, 'logicalHome', 'invalid relocation proof');
+    for (const [name, value] of [['sourceHome', sourceHome], ['physicalHome', physicalHome],
+        ['logicalHome', logicalHome]])
+        if (!canonical(value))
+            fail(`invalid relocation proof ${name}`);
+    if (sourceHome === physicalHome || sourceHome === logicalHome || physicalHome === logicalHome
+        || within(sourceHome, physicalHome) || within(physicalHome, sourceHome)
+        || within(sourceHome, logicalHome) || within(logicalHome, sourceHome)
+        || within(physicalHome, logicalHome) || within(logicalHome, physicalHome)) {
+        fail('invalid relocation proof homes');
+    }
+    if (stringField(record, 'behaviorRootRelative', 'invalid relocation proof') !== behaviorRelative(profile)) {
+        fail('invalid relocation proof behavior root');
+    }
+    const listed = record.elements;
+    if (!Array.isArray(listed) || listed.length !== ELEMENT_NAMES.length)
+        fail('invalid relocation proof elements');
+    const elements = new Map();
+    for (const item of listed) {
+        const value = object(item, 'invalid relocation proof element');
+        exactKeys(value, ['bytes', 'dev', 'entries', 'ino', 'logicalPath', 'name', 'physicalPath', 'sha256'], 'invalid relocation proof element');
+        const name = stringField(value, 'name', 'invalid relocation proof element');
+        if (!ELEMENT_NAMES.includes(name) || elements.has(name))
+            fail('invalid relocation proof element');
+        const logicalPath = stringField(value, 'logicalPath', 'invalid relocation proof element');
+        const physicalPath = stringField(value, 'physicalPath', 'invalid relocation proof element');
+        const expected = relativeOf(name, profile);
+        if (!canonical(logicalPath) || !canonical(physicalPath)
+            || relative(logicalHome, logicalPath) !== expected || relative(physicalHome, physicalPath) !== expected
+            || logicalPath !== under(logicalHome, expected) || physicalPath !== under(physicalHome, expected)) {
+            fail('relocation element paths differ');
+        }
+        const entries = naturalField(value, 'entries', 'invalid relocation proof element');
+        if (entries < 1)
+            fail('invalid relocation proof element');
+        elements.set(name, {
+            logicalPath, physicalPath,
+            dev: naturalField(value, 'dev', 'invalid relocation proof element'),
+            ino: naturalField(value, 'ino', 'invalid relocation proof element'),
+            sha256: hexField(value, 'sha256', 'invalid relocation proof element'),
+            entries,
+            bytes: naturalField(value, 'bytes', 'invalid relocation proof element'),
+        });
+    }
+    if (elements.size !== ELEMENT_NAMES.length)
+        fail('invalid relocation proof elements');
+    const digests = object(record.digests, 'invalid relocation proof digests');
+    exactKeys(digests, ['behavior', 'creation', 'release', 'relocation', 'repository', 'runtime'], 'invalid relocation proof digests');
+    for (const key of ['behavior', 'creation', 'release', 'relocation', 'repository', 'runtime']) {
+        hexField(digests, key, 'invalid relocation proof digests');
+    }
+    return { record, elements, digests };
+}
+async function verifyCopies(elements) {
+    for (const name of ELEMENT_NAMES) {
+        const meta = elements.get(name) ?? fail('invalid relocation proof elements');
+        await privateDirectory(dirname(meta.physicalPath), 'unsafe relocation destination');
+        const info = await lstat(meta.physicalPath);
+        if (!info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()
+            || info.dev !== meta.dev || info.ino !== meta.ino || await realpath(meta.physicalPath) !== meta.physicalPath
+            || await hashTree(meta.physicalPath, undefined, 'relocated tree differs') !== meta.sha256) {
+            fail('relocated tree differs');
+        }
+    }
+}
+async function readRelocated(physicalHome, profile, peer, elements) {
+    const runtimeReceipt = await readReceipt(join(under(physicalHome, runtimeFamily(profile)), 'bootstrap.json'), false);
+    const repositoryReceipt = await readReceipt(join(under(physicalHome, repositoryFamily(profile)), 'bootstrap.json'), false);
+    const behaviorReceipt = await readReceipt(join(under(physicalHome, behaviorFamily(profile)), 'behavior.json'), false);
+    const creationReceipt = await readReceipt(join(join(physicalHome, creationRelative(profile)), 'bootstrap.json'), false);
+    const releaseReceipt = await readReceipt(join(under(physicalHome, releaseRelative(profile)), 'bootstrap.json'), false);
+    const runtimeRuntime = validateRuntime(runtimeReceipt.runtime);
+    const repositoryRuntime = validateRuntime(repositoryReceipt.runtime);
+    const snapshot = validateSnapshot(repositoryReceipt.systemSnapshot);
+    const userNamespace = validateUserNamespace(repositoryReceipt.userNamespace);
+    const behavior = validateBehavior(peer, behaviorReceipt.descriptor);
+    if (runtimeReceipt.schemaVersion !== 3 || runtimeReceipt.backend !== 'linux-native'
+        || runtimeRuntime.root.path !== elements.get('runtime')?.logicalPath)
+        fail('relocated runtime receipt differs');
+    if (repositoryReceipt.schemaVersion !== 4 || repositoryReceipt.backend !== 'linux-native'
+        || repositoryRuntime.root.path !== elements.get('repository-runtime')?.logicalPath
+        || readRoot(snapshot).path !== elements.get('system')?.logicalPath) {
+        fail('relocated repository receipt differs');
+    }
+    if (behaviorReceipt.schemaVersion !== 1
+        || behavior.runtime.root.path !== elements.get('behavior-runtime')?.logicalPath) {
+        fail('relocated behavior receipt differs');
+    }
+    if (creationReceipt.schemaVersion !== 3 || creationReceipt.backend !== 'linux-native') {
+        fail('relocated creation receipt differs');
+    }
+    if (releaseReceipt.schemaVersion !== 2 || releaseReceipt.backend !== 'linux-native') {
+        fail('relocated release receipt differs');
+    }
+    return {
+        runtime: runtimeReceipt, repository: repositoryReceipt, snapshot, userNamespace,
+        runtimeRuntime, repositoryRuntime, behavior, behaviorReceipt, creationReceipt, releaseReceipt,
+    };
+}
+function sameTree(root, meta) {
+    return root.dev === meta.dev && root.ino === meta.ino && root.sha256 === meta.sha256;
+}
+async function validateRelocatedReceipts(family, logicalHome, physicalHome, profile, elements, peer, digests) {
+    const { runtime, repository, snapshot, userNamespace, runtimeRuntime, repositoryRuntime, behavior, behaviorReceipt, creationReceipt, releaseReceipt } = family;
+    const runtimeMeta = elements.get('runtime') ?? fail('invalid relocation proof elements');
+    const repositoryMeta = elements.get('repository-runtime') ?? fail('invalid relocation proof elements');
+    const systemMeta = elements.get('system') ?? fail('invalid relocation proof elements');
+    const behaviorMeta = elements.get('behavior-runtime') ?? fail('invalid relocation proof elements');
+    verifyReceiptDigest(runtime, 'relocated runtime receipt digest differs');
+    if (runtime.dshHome !== logicalHome || runtime.profile !== profile
+        || !sameTree(readRoot(runtimeRuntime), runtimeMeta)) {
+        fail('relocated runtime receipt differs');
+    }
+    if (digests.runtime !== runtime.receiptDigest)
+        fail('relocated runtime receipt digest differs');
+    verifyReceiptDigest(repository, 'relocated repository receipt digest differs');
+    const repositoryRuntimeDigest = linuxRuntimeDigest(repositoryRuntime);
+    if (repository.dshHome !== logicalHome || repository.profile !== profile
+        || !sameTree(readRoot(repositoryRuntime), repositoryMeta)
+        || !sameTree(readRoot(snapshot), systemMeta)
+        || repository.baseRuntimeDigest !== digest(runtime.runtime)
+        || repository.runtimeDigest !== digest(repository.runtime)
+        || repository.systemSnapshotDigest !== digest(repository.systemSnapshot)
+        || repository.userNamespaceDigest !== digest(repository.userNamespace)
+        || repository.ownerUid !== process.getuid?.() || repository.ownerGid !== process.getgid?.()) {
+        fail('relocated repository receipt differs');
+    }
+    if (digests.repository !== repository.receiptDigest)
+        fail('relocated repository receipt digest differs');
+    verifyReceiptDigest(behaviorReceipt, 'relocated behavior receipt digest differs');
+    if (behaviorReceipt.baseRuntimeDigest !== repositoryRuntimeDigest
+        || !sameTree(readRoot(behavior.runtime), behaviorMeta)) {
+        fail('relocated behavior receipt differs');
+    }
+    if (digests.behavior !== behaviorReceipt.receiptDigest)
+        fail('relocated behavior receipt digest differs');
+    verifyReceiptDigest(creationReceipt, 'relocated creation receipt digest differs');
+    validateCgroupRoots(creationReceipt.cgroupRoots, logicalHome);
+    if (creationReceipt.dshHome !== logicalHome || creationReceipt.profile !== profile
+        || creationReceipt.buildRuntimeDigest !== repositoryRuntimeDigest
+        || creationReceipt.repositoryRuntimeDigest !== repositoryRuntimeDigest
+        || creationReceipt.preparationDigest !== behaviorReceipt.receiptDigest
+        || creationReceipt.behaviorDigest !== peer.linuxPluginBehaviorRuntimeDigest(behavior)
+        || creationReceipt.systemSnapshotDigest !== digest(snapshot)
+        || creationReceipt.userNamespaceDigest !== digest(userNamespace)
+        || !isDeepStrictEqual(creationReceipt.behavior, behaviorReceipt.descriptor)
+        || creationReceipt.sourceCommit !== repository.sourceCommit
+        || creationReceipt.lockSha256 !== repository.lockSha256)
+        fail('relocated creation receipt differs');
+    if (digests.creation !== creationReceipt.receiptDigest)
+        fail('relocated creation receipt digest differs');
+    // Release build: the pins must describe the logical Home, and re-deriving
+    // them from the physical trees must reproduce the sealed digests.
+    verifyReceiptDigest(releaseReceipt, 'relocated release receipt digest differs');
+    exactKeys(releaseReceipt, ['backend', 'dshHome', 'profile', 'receiptDigest', 'releaseBuild', 'runtimeDigest',
+        'schemaVersion', 'sourceCommit'], 'relocated release receipt differs');
+    const pins = releaseLayout(releaseReceipt, logicalHome, profile);
+    const toolchainMeta = elements.get('release-toolchain') ?? fail('invalid relocation proof elements');
+    const storeMeta = elements.get('release-store') ?? fail('invalid relocation proof elements');
+    const cacheMeta = elements.get('release-cache') ?? fail('invalid relocation proof elements');
+    if (releaseReceipt.dshHome !== logicalHome || releaseReceipt.profile !== profile
+        || releaseReceipt.sourceCommit !== repository.sourceCommit
+        || releaseReceipt.runtimeDigest !== linuxRuntimeDigest(runtimeRuntime)
+        || pins.pnpmRoot.path !== toolchainMeta.logicalPath || pins.storeRoot.path !== storeMeta.logicalPath
+        || pins.cacheRoot.path !== cacheMeta.logicalPath) {
+        fail('relocated release receipt differs');
+    }
+    if (digests.release !== releaseReceipt.receiptDigest)
+        fail('relocated release receipt digest differs');
+    const physicalOf = (path) => {
+        const suffix = relative(logicalHome, path);
+        if (suffix === '' || suffix.startsWith('..') || isAbsolute(suffix)) {
+            fail('relocated release receipt differs');
+        }
+        return under(physicalHome, suffix);
+    };
+    for (const [label, item, kind] of [
+        ['toolchain', pins.pnpmRoot, 'tree'],
+        ['store', pins.storeRoot, 'tree'],
+        ['cache', pins.cacheRoot, 'tree'],
+        ['node', pins.nodeExecutable, 'executable'],
+        ['pnpm', pins.pnpmExecutable, 'executable'],
+    ]) {
+        const physical = physicalOf(item.path);
+        const computed = kind === 'tree' ? await releaseInventory(physical, undefined)
+            : await pinnedExecutableDigest(physical, undefined);
+        if (computed !== item.sha256)
+            fail(`relocated release ${label} differs`);
+    }
+}
+/** Re-derive a relocation proof from its physical Home without ever reading the
+ * logical Home; the proof must still describe a byte-identical, un-opened copy. */
+export async function verifyLinuxRsiNativeRelocation(proof) {
+    await openLinuxRsiNativeRelocatedFamily(proof);
+}
+function relocatedFamily(family, logicalHome) {
+    const message = 'relocated receipt differs';
+    const { runtime, behavior, creationReceipt, releaseReceipt } = family;
+    const sourceCommit = stringField(runtime, 'sourceCommit', message);
+    const lockSha256 = hexField(runtime, 'lockSha256', message);
+    const cgroupRoots = validateCgroupRoots(creationReceipt.cgroupRoots, logicalHome);
+    const releaseBuild = object(releaseReceipt.releaseBuild, message);
+    return {
+        runtime: { schemaVersion: 3, backend: 'linux-native', sourceCommit, lockSha256, runtime: family.runtimeRuntime },
+        repository: {
+            schemaVersion: 4,
+            backend: 'linux-native',
+            sourceCommit,
+            lockSha256,
+            runtime: family.repositoryRuntime,
+            systemSnapshot: family.snapshot,
+            userNamespace: family.userNamespace,
+        },
+        behavior,
+        creationBuild: {
+            schemaVersion: 3,
+            backend: 'linux-native',
+            sourceCommit,
+            behavior,
+            cgroupRoots: cgroupRoots,
+            buildRuntimeDigest: hexField(creationReceipt, 'buildRuntimeDigest', message),
+        },
+        release: {
+            schemaVersion: 2,
+            backend: 'linux-native',
+            sourceCommit: stringField(releaseReceipt, 'sourceCommit', message),
+            runtimeDigest: hexField(releaseReceipt, 'runtimeDigest', message),
+            releaseBuild: releaseBuild,
+        },
+    };
+}
+/** Verify a relocation proof and return its typed families in one pass, so the
+ * ~585 MB release trees are hashed once instead of twice. */
+export async function openLinuxRsiNativeRelocatedFamily(proof) {
+    const { record, elements, digests } = proofShape(proof);
+    if (relocationDigest(proof) !== digests.relocation)
+        fail('relocation proof digest differs');
+    if (process.platform !== 'linux')
+        fail('Linux native relocation verification requires Linux');
+    const peer = behaviorPeer();
+    const logicalHome = stringField(record, 'logicalHome', 'invalid relocation proof');
+    const physicalHome = stringField(record, 'physicalHome', 'invalid relocation proof');
+    const profile = stringField(record, 'profile', 'invalid relocation proof');
+    await verifyCopies(elements);
+    const family = await readRelocated(physicalHome, profile, peer, elements);
+    await validateRelocatedReceipts(family, logicalHome, physicalHome, profile, elements, peer, digests);
+    return relocatedFamily(family, logicalHome);
+}
+/** Re-open a verified relocation at another physical Home; callers may only
+ * supply the proof's own physical Home or its logical Home.
+ *
+ * The one supported case is the rename(2) cutover: `rename` preserves dev/ino,
+ * so the staged trees keep their sealed content identity while their paths move
+ * under the live Home. Receipts record logical paths, so only the element and
+ * receipt roots change; the proof itself stays the sealed staged record and is
+ * never rewritten. */
+export async function openLinuxRsiNativeRelocatedFamilyAt(proof, physicalHome) {
+    const { record, elements, digests } = proofShape(proof);
+    const stagedHome = stringField(record, 'physicalHome', 'invalid relocation proof');
+    if (!canonical(physicalHome))
+        fail('invalid relocation physical Home');
+    if (physicalHome === stagedHome)
+        return openLinuxRsiNativeRelocatedFamily(proof);
+    const logicalHome = stringField(record, 'logicalHome', 'invalid relocation proof');
+    if (physicalHome !== logicalHome)
+        fail('relocation proof does not describe this physical Home');
+    if (relocationDigest(proof) !== digests.relocation)
+        fail('relocation proof digest differs');
+    if (process.platform !== 'linux')
+        fail('Linux native relocation verification requires Linux');
+    const profile = stringField(record, 'profile', 'invalid relocation proof');
+    const moved = new Map();
+    for (const name of ELEMENT_NAMES) {
+        const meta = elements.get(name) ?? fail('invalid relocation proof elements');
+        const suffix = relative(stagedHome, meta.physicalPath);
+        if (suffix === '' || suffix.startsWith('..') || isAbsolute(suffix))
+            fail('relocation element paths differ');
+        moved.set(name, { ...meta, physicalPath: under(physicalHome, suffix) });
+    }
+    const peer = behaviorPeer();
+    await verifyCopies(moved);
+    const family = await readRelocated(physicalHome, profile, peer, moved);
+    await validateRelocatedReceipts(family, logicalHome, physicalHome, profile, moved, peer, digests);
+    return relocatedFamily(family, logicalHome);
+}
+const BASE_ELEMENTS = ['runtime', 'release-toolchain', 'release-store', 'release-cache'];
+async function baseFileDigest(path, signal) {
+    const fd = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await fd.stat();
+        if (!before.isFile() || before.nlink !== 1 || before.uid !== process.getuid?.()
+            || before.mode & 0o022 || before.size > MAX_BYTES)
+            fail('unsafe base runtime file');
+        const hash = createHash('sha256');
+        for await (const chunk of createReadStream(path, { fd: fd.fd, autoClose: false, highWaterMark: CHUNK, signal })) {
+            checkAbort(signal);
+            hash.update(chunk);
+        }
+        if (stamp(await fd.stat()) !== stamp(before) || stamp(await lstat(path)) !== stamp(before))
+            fail('base runtime file changed');
+        return hash.digest('hex');
+    }
+    finally {
+        await fd.close();
+    }
+}
+/** Validate bytes and package pins without executing the recorded toolchain. */
+async function baseRuntimePins(runtime, logicalHome, physicalHome, signal) {
+    const physical = (path) => rewrite(path, logicalHome, physicalHome);
+    for (const path of [runtime.nodePath, join(runtime.nativePnpmRoot, 'node')]) {
+        if (await pinnedExecutableDigest(physical(path), signal) !== runtime.nodeSha256)
+            fail('source runtime Node pin differs');
+    }
+    if (await baseFileDigest(physical(join(runtime.root.path, 'pnpm-lock.yaml')), signal) !== runtime.lockSha256)
+        fail('source runtime lock differs');
+    const native = await readReceipt(physical(join(runtime.nativePnpmRoot, 'package.json')), false);
+    if (native.name !== '@pnpm/exe' || native.version !== runtime.versions.pnpm)
+        fail('source runtime native manifest differs');
+    for (const [key, name] of [['typescript', 'typescript'], ['cordis', '@deepseek-ai/cordis'],
+        ['tools', '@deepseek-ai/dsh-tools'], ['systemPrompt', '@deepseek-ai/dsh-system-prompt']]) {
+        const manifest = await readReceipt(physical(join(runtime.modulesPath, name, 'package.json')), false);
+        if (manifest.version !== runtime.versions[key])
+            fail('source runtime package differs');
+    }
+}
+async function baseRelativeLinks(root, signal) {
+    let entries = 0;
+    const visit = async (path) => {
+        checkAbort(signal);
+        if (++entries > MAX_ENTRIES)
+            fail('base tree entry bound exceeded');
+        const info = await lstat(path);
+        if (info.isSymbolicLink()) {
+            const target = await readlink(path);
+            if (isAbsolute(target) || !within(resolve(dirname(path), target), root)
+                || !within(await realpath(path), root))
+                fail('base runtime link escaped root');
+        }
+        else if (info.isDirectory()) {
+            for (const name of (await readdir(path)).sort())
+                await visit(join(path, name));
+            if (stamp(await lstat(path)) !== stamp(info))
+                fail('base runtime directory changed');
+        }
+    };
+    await visit(root);
+}
+async function authenticateBaseAt(logicalHome, physicalHome, profile, signal) {
+    checkAbort(signal);
+    await privateDirectory(under(physicalHome, runtimeFamily(profile)), 'unsafe base runtime family');
+    await privateDirectory(under(physicalHome, releaseRelative(profile)), 'unsafe base release family');
+    await inventory(under(physicalHome, runtimeFamily(profile)), ['bootstrap.json', 'runtime'], 'source runtime family differs');
+    const { runtime, runtimeReceipt, sourceCommit } = await authenticateBaseRuntime(logicalHome, profile, signal, physicalHome);
+    await baseRelativeLinks(under(physicalHome, runtimeRelative(profile)), signal);
+    await baseRuntimePins(runtime, logicalHome, physicalHome, signal);
+    const releaseReceipt = await authenticateReleaseSource(logicalHome, profile, runtime, sourceCommit, signal, physicalHome);
+    // Runtime hashing also rejects hardlinks, writable entries and escaping links
+    // in the release trees; schema-2 pins use a different inventory digest.
+    const releaseTrees = [];
+    for (const name of ['toolchain', 'store', 'cache']) {
+        const path = under(physicalHome, releaseTreeRelative(profile, name)), before = await lstat(path);
+        const sha256 = await hashTree(path, signal, 'unsafe release tree');
+        if (stamp(await lstat(path)) !== stamp(before))
+            fail('source release tree changed during inspection');
+        releaseTrees.push({ path, dev: before.dev, ino: before.ino, mode: before.mode, sha256 });
+    }
+    checkAbort(signal);
+    return { runtime, runtimeReceipt, releaseReceipt, releaseTrees };
+}
+function projectBase(state) {
+    const sourceCommit = stringField(state.runtimeReceipt, 'sourceCommit', 'invalid base receipt');
+    return {
+        runtime: { schemaVersion: 3, backend: 'linux-native', sourceCommit,
+            lockSha256: hexField(state.runtimeReceipt, 'lockSha256', 'invalid base receipt'), runtime: state.runtime },
+        release: { schemaVersion: 2, backend: 'linux-native', sourceCommit,
+            runtimeDigest: hexField(state.releaseReceipt, 'runtimeDigest', 'invalid base receipt'),
+            releaseBuild: object(state.releaseReceipt.releaseBuild, 'invalid base receipt') },
+    };
+}
+async function inspectBaseHome(home) {
+    const info = await lstat(home);
+    if (!canonical(home) || !info.isDirectory() || info.isSymbolicLink() || info.uid !== process.getuid?.()
+        || info.mode & 0o022 || await realpath(home) !== home)
+        fail('unsafe base Home');
+}
+/** Read existing receipts through their canonical logical Home spelling. Only
+ * same-inode moves are supported: ordinary copied runtime roots fail dev/ino.
+ * Release schema 2 carries content pins, not historical root inode fields. */
+export async function inspectLinuxRsiNativeBaseAt(input) {
+    const { logicalHome, physicalHome, profile, signal } = input;
+    if (!canonical(logicalHome) || !canonical(physicalHome) || !PROFILE.test(profile)
+        || logicalHome !== physicalHome && (within(logicalHome, physicalHome) || within(physicalHome, logicalHome)))
+        fail('invalid base inspection identity');
+    if (process.platform !== 'linux')
+        fail('Linux native base inspection requires Linux');
+    await inspectBaseHome(physicalHome);
+    return projectBase(await authenticateBaseAt(logicalHome, physicalHome, profile, signal));
+}
+function baseRelocationDigest(proof) {
+    return digest({ schemaVersion: proof.schemaVersion, backend: proof.backend, purpose: proof.purpose,
+        profile: proof.profile, sourceHome: proof.sourceHome, physicalHome: proof.physicalHome, logicalHome: proof.logicalHome,
+        elements: proof.elements, digests: { runtime: proof.digests.runtime, release: proof.digests.release } });
+}
+function baseProofShape(proof) {
+    const record = object(proof, 'invalid base relocation proof');
+    exactKeys(record, ['schemaVersion', 'backend', 'purpose', 'profile', 'sourceHome', 'physicalHome', 'logicalHome', 'elements', 'digests'], 'invalid base relocation proof');
+    if (record.schemaVersion !== 1 || record.backend !== 'linux-native' || record.purpose !== 'pre-owner-base')
+        fail('invalid base relocation proof');
+    const identity = { sourceHome: stringField(record, 'sourceHome', 'invalid base relocation proof'),
+        physicalHome: stringField(record, 'physicalHome', 'invalid base relocation proof'),
+        logicalHome: stringField(record, 'logicalHome', 'invalid base relocation proof'),
+        profile: stringField(record, 'profile', 'invalid base relocation proof') };
+    pureIdentity(identity);
+    const list = record.elements;
+    if (!Array.isArray(list) || list.length !== BASE_ELEMENTS.length)
+        fail('invalid base relocation elements');
+    const elements = new Map();
+    for (const item of list) {
+        const value = object(item, 'invalid base relocation element');
+        exactKeys(value, ['name', 'logicalPath', 'physicalPath', 'dev', 'ino', 'sha256', 'entries', 'bytes'], 'invalid base relocation element');
+        const name = stringField(value, 'name', 'invalid base relocation element');
+        if (!BASE_ELEMENTS.includes(name) || elements.has(name))
+            fail('invalid base relocation element');
+        const logicalPath = stringField(value, 'logicalPath', 'invalid base relocation element');
+        const physicalPath = stringField(value, 'physicalPath', 'invalid base relocation element');
+        const suffix = relativeOf(name, identity.profile);
+        if (logicalPath !== under(identity.logicalHome, suffix) || physicalPath !== under(identity.physicalHome, suffix))
+            fail('base relocation element paths differ');
+        const entries = naturalField(value, 'entries', 'invalid base relocation element');
+        const bytes = naturalField(value, 'bytes', 'invalid base relocation element');
+        if (entries < 1 || entries > MAX_ENTRIES || bytes > MAX_BYTES)
+            fail('invalid base relocation element');
+        elements.set(name, { logicalPath, physicalPath, entries, bytes,
+            dev: naturalField(value, 'dev', 'invalid base relocation element'), ino: naturalField(value, 'ino', 'invalid base relocation element'),
+            sha256: hexField(value, 'sha256', 'invalid base relocation element') });
+    }
+    const digests = object(record.digests, 'invalid base relocation digests');
+    exactKeys(digests, ['runtime', 'release', 'relocation'], 'invalid base relocation digests');
+    for (const key of ['runtime', 'release', 'relocation'])
+        hexField(digests, key, 'invalid base relocation digests');
+    if (baseRelocationDigest(proof) !== digests.relocation)
+        fail('base relocation proof digest differs');
+    return elements;
+}
+async function openBase(proof, physicalHome, elements) {
+    if (process.platform !== 'linux')
+        fail('Linux native base relocation verification requires Linux');
+    await inspectBaseHome(physicalHome);
+    for (const name of BASE_ELEMENTS) {
+        const meta = elements.get(name) ?? fail('invalid base relocation elements');
+        const path = under(physicalHome, relativeOf(name, proof.profile));
+        const info = await lstat(path);
+        if (info.dev !== meta.dev || info.ino !== meta.ino
+            || await hashTree(path, undefined, 'relocated base tree differs') !== meta.sha256)
+            fail('relocated base tree differs');
+    }
+    const state = await authenticateBaseAt(proof.logicalHome, physicalHome, proof.profile);
+    // Schema-2 receipts have content pins but no inode fields. Compare the actual
+    // post-authentication observations to the proof as well as the initial scan.
+    for (const tree of state.releaseTrees) {
+        const name = BASE_ELEMENTS.find(value => under(physicalHome, relativeOf(value, proof.profile)) === tree.path);
+        const meta = name && elements.get(name);
+        if (!meta || tree.dev !== meta.dev || tree.ino !== meta.ino || tree.sha256 !== meta.sha256)
+            fail('relocated base tree changed during inspection');
+    }
+    if (state.runtimeReceipt.receiptDigest !== proof.digests.runtime || state.releaseReceipt.receiptDigest !== proof.digests.release)
+        fail('relocated base receipt digest differs');
+    return projectBase(state);
+}
+export async function openLinuxRsiNativeRelocatedBase(proof) {
+    const elements = baseProofShape(proof);
+    return openBase(proof, proof.physicalHome, elements);
+}
+export async function openLinuxRsiNativeRelocatedBaseAt(proof, physicalHome) {
+    const elements = baseProofShape(proof);
+    if (physicalHome !== proof.physicalHome && physicalHome !== proof.logicalHome)
+        fail('base relocation proof does not describe this physical Home');
+    return openBase(proof, physicalHome, elements);
+}
+/** Read-only before any acquisition. Even an absent Home must have an
+ * existing canonical parent; recursive mkdir must never traverse an alias.
+ * The early non-Linux pass checks path traversal only, before the platform gate.
+ * Actual Linux acquisition additionally requires owner-private directories. */
+async function baseDestinationParents(physicalHome, strict) {
+    const directory = async (path) => {
+        const info = await lstat(path);
+        if (!info.isDirectory() || info.isSymbolicLink() || await realpath(path) !== path
+            || strict && (info.uid !== process.getuid?.() || (info.mode & 0o077) !== 0))
+            fail('unsafe base destination parent');
+    };
+    if (!await exists(physicalHome)) {
+        await directory(dirname(physicalHome));
+        return;
+    }
+    await directory(physicalHome);
+    // Check both parents before creating either parent or profile family.
+    for (const name of ['rsi-linux-runtimes', 'rsi-release-builds']) {
+        const path = join(physicalHome, name);
+        if (await exists(path))
+            await directory(path);
+    }
+}
+async function createBaseDirectory(path) {
+    // No recursive mkdir or chmod: EEXIST (including a concurrent symlink) fails
+    // without modifying an existing target. The outer caller owns the Home lock.
+    await mkdir(path, { mode: 0o700 });
+    await privateDirectory(path, 'unsafe base destination parent');
+}
+export async function relocateLinuxRsiNativeBase(input) {
+    pureIdentity(input);
+    const { sourceHome, physicalHome, logicalHome, profile, signal } = input;
+    await baseDestinationParents(physicalHome, false);
+    if (process.platform !== 'linux')
+        fail('Linux native base relocation requires Linux');
+    await baseDestinationParents(physicalHome, true);
+    checkAbort(signal);
+    await privateDirectory(sourceHome, 'unsafe source Home');
+    if (input.existingLogicalHome === undefined) {
+        if (await exists(logicalHome))
+            fail('logical Home already exists');
+    }
+    else
+        await attestedLogicalHome(logicalHome);
+    if (await exists(physicalHome))
+        await privateDirectory(physicalHome, 'unsafe physical Home');
+    else
+        await createBaseDirectory(physicalHome);
+    for (const path of [runtimeFamily(profile), releaseRelative(profile)]) {
+        if (await exists(under(physicalHome, path)))
+            fail('base relocation target already exists');
+    }
+    const source = await authenticateBaseAt(sourceHome, sourceHome, profile, signal);
+    await baseDestinationParents(physicalHome, true);
+    for (const parent of ['rsi-linux-runtimes', 'rsi-release-builds']) {
+        const path = join(physicalHome, parent);
+        if (!await exists(path))
+            await createBaseDirectory(path);
+        else
+            await privateDirectory(path, 'unsafe base destination parent');
+    }
+    await createBaseDirectory(under(physicalHome, runtimeFamily(profile)));
+    await createBaseDirectory(under(physicalHome, releaseRelative(profile)));
+    const runtimeCopy = await copyTree(source.runtime.root.path, under(physicalHome, runtimeRelative(profile)), signal, source.runtime.root.sha256);
+    const copies = new Map([['runtime', runtimeCopy]]);
+    for (const name of BASE_ELEMENTS.slice(1)) {
+        const path = relativeOf(name, profile);
+        copies.set(name, await copyTree(under(sourceHome, path), under(physicalHome, path), signal));
+    }
+    const runtimeReceipt = relocatedRuntimeReceipt(source.runtimeReceipt, sourceHome, logicalHome, runtimeCopy, under(logicalHome, runtimeRelative(profile)));
+    const runtime = validateRuntime(runtimeReceipt.runtime);
+    const releaseReceipt = relocatedReleaseReceipt(source.releaseReceipt, sourceHome, logicalHome, linuxRuntimeDigest(runtime));
+    const proof = { schemaVersion: 1, backend: 'linux-native', purpose: 'pre-owner-base',
+        profile, sourceHome, physicalHome, logicalHome,
+        elements: BASE_ELEMENTS.map(name => ({ ...element(name, under(logicalHome, relativeOf(name, profile)), copies.get(name)), name })),
+        digests: { runtime: stringField(runtimeReceipt, 'receiptDigest', 'invalid base receipt'),
+            release: stringField(releaseReceipt, 'receiptDigest', 'invalid base receipt'), relocation: '' } };
+    proof.digests.relocation = baseRelocationDigest(proof);
+    await writeReceipt(join(under(physicalHome, runtimeFamily(profile)), 'bootstrap.json'), runtimeReceipt);
+    await writeReceipt(join(under(physicalHome, releaseRelative(profile)), 'bootstrap.json'), releaseReceipt);
+    await openLinuxRsiNativeRelocatedBase(proof);
+    if (!isDeepStrictEqual(await authenticateBaseAt(sourceHome, sourceHome, profile, signal), source))
+        fail('source base changed during relocation');
+    checkAbort(signal);
+    return proof;
+}
+//# sourceMappingURL=rsi-linux-native-relocation.js.map