@kungfu-tech/buildchain 4.0.2-alpha.46 → 4.0.2-alpha.47

package/dist/site/public-surface-audit.json

@@ -10933,8 +10933,8 @@
     "workflowRegistryPath": "dist/site/workflow-registry.json",
     "pageRegistryPath": "dist/site/page-registry.json",
     "cliRegistryDigest": "fbc23073bbae240489a2f826b2c26daadc58e704050c5f8df366509f5c5a1c3e",
-    "workflowRegistryDigest": "cc88d63b25d61394b3bbc28cb81b72f3c7786d85bf7c5f68ab6baa426b9a552b",
-    "pageRegistryDigest": "6c4a4be1b2bc15c7842aa958b128f76ec405b9585f403e5cc604c16781a40afc"
+    "workflowRegistryDigest": "ff88de1ac8103567107ee82901cb67aa06cc6a0b8e8edd6d7773f3f4e2f15caa",
+    "pageRegistryDigest": "decc7df0ff93d3befe128f88cea33a616f6b2ca4caebf4ce3c62ab70a2a348fc"
   },
   "comparison": {
     "missingCliRegistry": [],

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-09-06T15:52:10.000Z",
-  "publishedAt": "2026-09-06T15:52:10.000Z",
+  "generatedAt": "2026-09-06T16:34:33.000Z",
+  "publishedAt": "2026-09-06T16:34:33.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
+  "sourceRevision": "6939bc6aa982b8558aeb1ba0608663f684630505",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.46",
+    "version": "4.0.2-alpha.47",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-09-06T15:52:10.000Z",
-  "publishedAt": "2026-09-06T15:52:10.000Z",
+  "generatedAt": "2026-09-06T16:34:33.000Z",
+  "publishedAt": "2026-09-06T16:34:33.000Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "53db887810f830c27680040bc35969238b5d2a88",
+  "sourceRevision": "6939bc6aa982b8558aeb1ba0608663f684630505",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "4.0.2-alpha.46",
+    "version": "4.0.2-alpha.47",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -253,7 +253,7 @@
       "path": "docs/node-api-reference.md",
       "plane": "use",
       "exists": true,
-      "digest": "sha256:69f4e87e7cbf154f4b3241269e806e7998f9a517fb8ada64f120239c49abbd78"
+      "digest": "sha256:3c90865d8814e238135c365c3d8f54279ce44bf06c35d907ad3957b862a3a51e"
     },
     {
       "id": "build-facts",

package/dist/site/workflow-registry.json

@@ -2746,7 +2746,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.46",
+      "introducedVersion": "4.0.2-alpha.47",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -3943,7 +3943,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.46",
+      "introducedVersion": "4.0.2-alpha.47",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -5970,7 +5970,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.46",
+      "introducedVersion": "4.0.2-alpha.47",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6001,7 +6001,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.46",
+      "introducedVersion": "4.0.2-alpha.47",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",
@@ -6032,7 +6032,7 @@
       "status": "preview",
       "owner": "buildchain-workflows",
       "maturity": "preview",
-      "introducedVersion": "4.0.2-alpha.46",
+      "introducedVersion": "4.0.2-alpha.47",
       "compatibilityPromise": "preserved-through-the-v3-major-line",
       "deprecationReplacement": "",
       "sunsetCondition": "explicit-breaking-change-review-in-a-future-major-line",

package/docs/node-api-reference.md

@@ -639,7 +639,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:189` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain";` | `packages/core/publication-sealed-bundle.js:190` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain";` | `packages/core/release-propagation-work.js:486` |
@@ -1328,7 +1328,7 @@ Target: `./packages/core/index.js`. Public symbols: 636.
 | `verifyPublicationAdmission` | function: function verifyPublicationAdmission({ admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {}) | { admission, registry, runnerProvenance, controlPlaneAudit, publicationEvidence, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationAdmission } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:791` |
 | `verifyPublicationQualificationReceipt` | function: function verifyPublicationQualificationReceipt({ receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {}) | { receipt, capability, gateAggregate, expected = {}, usedNonces = [], now = new Date(), } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationQualificationReceipt } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-authority.js:1096` |
 | `verifyPublicationReproducibility` | function: function verifyPublicationReproducibility({ cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {}) | { cwd = process.cwd(), sourceSha = "", output = DEFAULT_OUTPUT, promote = false, keepWorkspaces = false, pullToolchain = true, packageName = "", allowUnpinnedToolchain = false, overlayPaths = [DEFAULT_REGISTRY_INPUT_DIR, DEFAULT_REGISTRY_HYDRATION], } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | local-filesystem-write | `import { verifyPublicationReproducibility } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-reproducibility.js:869` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:189` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/core";` | `packages/core/publication-sealed-bundle.js:190` |
 | `verifyReleaseCandidateRecovery` | function: function verifyReleaseCandidateRecovery({ candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {}) | { candidateRepository, targetRepository, expectedRunId, expectedWorkflowFile, expectedWorkflowName, channel, targetRef, targetSha, targetRefSha = targetSha, targetTree, expectedSourceTree = "", expectedCandidateRoot = "", expectedRuntimeSha, expectedTransactionId = "", existingTransaction = undefined, run, workflow, pullRequest, ancestry, anchorProvenance = undefined, passport, buildSummary, controllerReceipts = [], platformManifests = [], platformManifestEvidence = [], productPayloadManifests = [], artifacts = [], publicationVersion = "", currentToolingSha, recoveryRunId = "", createdAt = new Date().toISOString(), } = {} | unknown | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleaseCandidateRecovery } from "@kungfu-tech/buildchain/core";` | `packages/core/release-candidate-recovery.js:444` |
 | `verifyReleasePassport` | function: async function verifyReleasePassport({ passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {}) | { passportLocation, artifactEvidenceLocation = "", publishEvidenceLocation = "", impactLocation = "", agentIndexLocation = "", productMechanismLocation = "", kfdAgentHubEvidenceLocation = "", kfdAdopterManifestLocation = "", kfdAdopterManifestGateLocation = "", kfdSupportEvidenceLocation = "", checkedAt = nowIso(), } = {} | Promise<unknown> | Errors from called operations may propagate; no narrower throw contract is declared in source. | none-detected-by-static-source-scan | `import { verifyReleasePassport } from "@kungfu-tech/buildchain/core";` | `packages/core/release-passport.js:2729` |
 | `verifyReleasePropagationWork` | function: function verifyReleasePropagationWork(input) | input | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyReleasePropagationWork } from "@kungfu-tech/buildchain/core";` | `packages/core/release-propagation-work.js:486` |
@@ -2317,7 +2317,7 @@ Target: `./packages/core/publication-sealed-bundle.js`. Public symbols: 3.
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | `createPublicationSealedBundle` | function: function createPublicationSealedBundle({ candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {}) | { candidate, packageName, packageVersion, npmTarballPath, npmIntegrity, releaseAssetPaths = [], githubReleaseRequired = true, } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | subprocess | `import { createPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:97` |
 | `PUBLICATION_SEALED_BUNDLE_CONTRACT` | constant: const PUBLICATION_SEALED_BUNDLE_CONTRACT | none | value | Import does not declare a throw contract. | none-on-import | `import { PUBLICATION_SEALED_BUNDLE_CONTRACT } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:11` |
-| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:189` |
+| `verifyPublicationSealedBundle` | function: function verifyPublicationSealedBundle({ bundleRoot, manifest } = {}) | { bundleRoot, manifest } = {} | unknown | May throw an Error on rejected input or failed operations; follow the linked source contract. | none-detected-by-static-source-scan | `import { verifyPublicationSealedBundle } from "@kungfu-tech/buildchain/publication-sealed-bundle";` | `packages/core/publication-sealed-bundle.js:190` |
 
 ## `@kungfu-tech/buildchain/paper`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "4.0.2-alpha.46",
+  "version": "4.0.2-alpha.47",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/packages/core/publication-sealed-bundle.js

@@ -160,7 +160,8 @@ function verifyNpmPackageSet(manifest, files, resolvedRoot) {
       const file = selectFile(files, entry.path, "npmPackages.path");
       const absolutePath = path.resolve(resolvedRoot, file.path);
       const metadata = JSON.parse(
-        execFileSync("tar", ["-xOf", absolutePath, "package/package.json"], {
+        execFileSync("tar", ["-xOf", path.basename(absolutePath), "package/package.json"], {
+          cwd: path.dirname(absolutePath),
           encoding: "utf8",
         }),
       );

package/packages/core/v4-universal-workflow-bootstrap.js

@@ -275,7 +275,7 @@ export function v4UniversalWorkflowRequestRoot(value) {
 export function v4ProductStateVersion(value, requestedSha) { const sourceSha = exactSha(requestedSha, "requestedSha"), ref = nonEmpty(value?.ref, "productStateRef.ref"), prefix = `refs/heads/buildchain/v4-product-state/${sourceSha}-`; if (!ref.startsWith(prefix)) fail("recovery-state-mismatch", "release recovery product state does not bind the requested source"); const match = ref.slice(prefix.length).match(/^(\d+)-(\d+)-(\d+)(?:-alpha-(\d+))?$/u); if (!match) fail("invalid-recovery-version", "release recovery product state version is invalid"); return `${match[1]}.${match[2]}.${match[3]}${match[4] === undefined ? "" : `-alpha.${match[4]}`}`; }
 export function selectV4FinalizedProductPublicationVersion(value) { const requestedSha = exactSha(value.requestedSha, "requestedSha"), requestedTree = exactSha(value.requestedTree, "requestedTree"), lane = nonEmpty(value.targetRef, "targetRef").match(/^(alpha|release)\/v(\d+)\/v(\d+)\.(\d+)$/u); if (!lane || lane[2] !== lane[3]) fail("invalid-finalization-lane", "product publication finalization target is not a release lane"); const expectedAlpha = lane[1] === "alpha", versions = []; for (const row of Array.isArray(value.recoveryStates) ? value.recoveryStates : []) { const stateRef = row?.stateRef, match = String(stateRef?.ref || "").match(/^refs\/heads\/buildchain\/v4-product-state\/([0-9a-f]{40})-(\d+)-(\d+)-(\d+)(?:-alpha-(\d+))?$/u); if (!match || match[2] !== lane[2] || match[3] !== lane[4]) continue; const stateTree = exactSha(row?.stateCommit?.tree?.sha, "productStateCommit.tree.sha"); if (stateTree !== requestedTree || !new Set(["ahead", "identical"]).has(row.headComparisonStatus)) continue; const sourceSha = exactSha(match[1], "productStateRef.sourceSha"), version = v4ProductStateVersion(stateRef, sourceSha), parsed = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u); if ((parsed[4] !== undefined) !== expectedAlpha) continue; if (stateRef?.object?.type !== "commit" || exactSha(stateRef?.object?.sha, "productStateRef.object.sha") !== exactSha(row?.stateCommit?.sha, "productStateCommit.sha") || row.stateCommit.parents?.length !== 1 || exactSha(row.stateCommit.parents[0]?.sha, "productStateCommit.parents[0].sha") !== sourceSha) fail("finalization-state-mismatch", "product publication finalization state does not bind its source"); if (row.exactTagRef && (row.exactTagRef.ref !== `refs/tags/v${version}` || row.exactTagRef.object?.type !== "commit" || exactSha(row.exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha)) fail("finalization-tag-mismatch", "product publication finalization tag does not bind its source"); versions.push(version); } const selected = [...new Set(versions)].sort(); if (selected.length > 1) fail("finalization-state-ambiguous", `publication head ${requestedSha} matches multiple product versions`); return selected[0] || ""; }
 export function selectV4RecoveredProductPublicationVersion(value) {
-  if (value.routeDecision !== "Resume") return ""; const version = nonEmpty(value.candidateVersion, "candidateVersion"), sourceSha = exactSha(value.requestedSha, "requestedSha"), candidate = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u); if (!candidate) fail("invalid-recovery-version", "release recovery candidate version is invalid"); if (value.explicitResume) return version;
+  if (value.routeDecision !== "Resume") return ""; const candidateVersion = nonEmpty(value.candidateVersion, "candidateVersion"), version = value.channel === "stable" ? candidateVersion.replace(/-alpha\.\d+$/u, "") : candidateVersion, sourceSha = exactSha(value.requestedSha, "requestedSha"), candidate = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u); if (!candidate) fail("invalid-recovery-version", "release recovery candidate version is invalid"); if (value.explicitResume) return version;
   const states = Array.isArray(value.recoveryStates) ? value.recoveryStates : []; if (states.length) { const recovered = [...new Set(states.map(({ stateRef, stateCommit, exactTagRef }) => { const selected = v4ProductStateVersion(stateRef, sourceSha), parsed = selected.match(/^(\d+)\.(\d+)\.(\d+)(?:-alpha\.(\d+))?$/u), parents = stateCommit?.parents || []; if (stateRef?.object?.type !== "commit" || exactSha(stateRef?.object?.sha, "productStateRef.object.sha") !== exactSha(stateCommit?.sha, "productStateCommit.sha") || parents.length !== 1 || exactSha(parents[0]?.sha, "productStateCommit.parents[0].sha") !== sourceSha) fail("recovery-state-mismatch", "release recovery product state commit does not bind the requested source"); if (exactTagRef && (exactTagRef.ref !== `refs/tags/v${selected}` || exactTagRef.object?.type !== "commit" || exactSha(exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha)) fail("recovery-tag-mismatch", "release recovery exact tag does not bind the requested source"); if (parsed[1] !== candidate[1] || parsed[2] !== candidate[2] || parsed[3] !== candidate[3] || (parsed[4] === undefined) !== (candidate[4] === undefined)) fail("recovery-state-mismatch", "release recovery product state is outside the candidate release line"); return selected; }))]; if (recovered.length !== 1) fail("recovery-state-ambiguous", "release recovery requires one exact product publication state; provide an exact transaction identity"); return recovered[0]; }
   if (!value.exactTagRef) fail("recovery-tag-missing", "release recovery requires an exact partial-publication tag"); if (value.exactTagRef.ref !== `refs/tags/v${version}` || value.exactTagRef.object?.type !== "commit" || exactSha(value.exactTagRef.object?.sha, "exactTagRef.object.sha") !== sourceSha) fail("recovery-tag-mismatch", "release recovery exact tag does not bind the requested source");
   return version;

package/scripts/v4-universal-workflow-engine.mjs

@@ -265,11 +265,11 @@ async function observedSourceTimestamp(repository, sourceSha) {
     fail("protected publication source timestamp is unavailable");
   return new Date(observed).toISOString();
 }
-async function observeProductPublicationRecovery(repository, sourceSha, candidateVersion) {
+async function observeProductPublicationRecovery(repository, sourceSha, candidateVersion, channel) {
   const apiUrl = process.env.GITHUB_API_URL || "https://api.github.com", token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "", prefix = `heads/buildchain/v4-product-state/${sourceSha}-`;
   const stateRefs = (await githubJson({ apiUrl, token, path: `/repos/${repository}/git/matching-refs/${prefix}`, allowNotFound: true })) || [];
   const recoveryStates = await Promise.all(stateRefs.map(async (stateRef) => { const version = v4ProductStateVersion(stateRef, sourceSha); const [stateCommit, exactTagRef] = await Promise.all([githubJson({ apiUrl, token, path: `/repos/${repository}/git/commits/${stateRef.object.sha}` }), githubJson({ apiUrl, token, path: `/repos/${repository}/git/ref/tags/v${version}`, allowNotFound: true })]); return { stateRef, stateCommit, exactTagRef }; }));
-  const exactTagRef = recoveryStates.length ? undefined : await githubJson({ apiUrl, token, path: `/repos/${repository}/git/ref/tags/v${encodeURIComponent(candidateVersion)}`, allowNotFound: true }); return { recoveryStates, exactTagRef };
+  const exactTagRef = recoveryStates.length ? undefined : await githubJson({ apiUrl, token, path: `/repos/${repository}/git/ref/tags/v${encodeURIComponent(channel === "stable" ? candidateVersion.replace(/-alpha\.\d+$/u, "") : candidateVersion)}`, allowNotFound: true }); return { recoveryStates, exactTagRef };
 }
 async function materializeProductPublicationIntent({
   candidate,
@@ -282,8 +282,8 @@ async function materializeProductPublicationIntent({
   );
   const sourceTimestamp = await observedSourceTimestamp(repository, route.requestedSha);
   const version = String(candidate.publicationVersion || candidate.version || "").trim(), explicitResume = String(inputs["resume-transaction-id"] || "") !== "";
-  const recovery = route.decision !== "Resume" || explicitResume ? {} : await observeProductPublicationRecovery(repository, route.requestedSha, version);
-  const recoveredVersion = selectV4RecoveredProductPublicationVersion({ routeDecision: route.decision, candidateVersion: version, requestedSha: route.requestedSha, explicitResume, ...recovery });
+  const recovery = route.decision !== "Resume" || explicitResume ? {} : await observeProductPublicationRecovery(repository, route.requestedSha, version, route.channel);
+  const recoveredVersion = selectV4RecoveredProductPublicationVersion({ routeDecision: route.decision, candidateVersion: version, channel: route.channel, requestedSha: route.requestedSha, explicitResume, ...recovery });
   execFileSync(
     process.execPath,
     [