@synopackageland/cli 0.5.0 → 0.5.3

package/dist/standalone/root-ops.js

@@ -68,6 +68,16 @@ function readRootOp(path, file) {
  */
 export function renderRootTaskScript(manifest, op) {
     const body = op.body.endsWith("\n") ? op.body : `${op.body}\n`;
+    // Wrapped helper operations expose no output; don't leave a root-owned
+    // output directory or files for an operation whose result is task history.
+    if (op.protectedOutput && op.exposeOutput === false)
+        return `${rootTaskHeader(manifest.package, op.name)}${manifest.spkVersion}.
+set -eu
+PATH=/usr/sbin:/usr/bin:/sbin:/bin
+export PATH
+/bin/sh -eu <<'${ROOT_OP_END}'
+${body}${ROOT_OP_END}
+`;
     return `${rootTaskHeader(manifest.package, op.name)}${manifest.spkVersion}.
 # Approved by a DSM administrator; runs only when this task is run.
 set -eu

package/dist/standalone/root-window.js

@@ -5,7 +5,7 @@ export function rootTasks(manifest) {
         name: rootTaskName(manifest.package, op.name),
         header: rootTaskHeader(manifest.package, op.name),
         script: renderRootTaskScript(manifest, op),
-        output: op.protectedOutput !== true,
+        output: op.exposeOutput ?? op.protectedOutput !== true,
     }));
 }
 /**

package/dist/standalone/spk.d.ts

@@ -1,6 +1,7 @@
 import { type NativeArchFamily } from "../build-spk/dsm-arch.js";
 import type { StandaloneManifest } from "./manifest.js";
 import type { HelperArtifact } from "./helper.js";
+import { type AuthorizationArtifact } from "./authorization.js";
 export declare const LIFECYCLE_SCRIPTS: readonly ["preinst", "postinst", "preuninst", "postuninst", "preupgrade", "postupgrade", "start-stop-status"];
 export declare class StandaloneBuildError extends Error {
     readonly code: string;
@@ -13,6 +14,7 @@ export interface AssembleOptions {
     cgiPath: string;
     outputPath: string;
     helper?: HelperArtifact;
+    authorization?: AuthorizationArtifact;
     daemonControl?: string;
     /** The compiled background worker, required exactly when the manifest declares background. */
     backgroundWorker?: string;

package/dist/standalone/spk.js

@@ -18,6 +18,7 @@ import { hostScriptName, renderHostAdapterScript } from "./host-adapter.js";
 import { copyDaemonPayload } from "./daemon.js";
 import { BACKGROUND_UNIT_DIR, BACKGROUND_WORKER_PAYLOAD, backgroundUnitName, renderBackgroundUnit } from "./background.js";
 import { renderStandaloneResource } from "./resource.js";
+import { authorizationPlan } from "./authorization.js";
 import { renderSharedFolderUpgradeWizardFiles, sharedFolderInstallSteps } from "./shared-folder.js";
 const FILE_MODE = 0o644;
 const EXEC_MODE = 0o755;
@@ -47,6 +48,8 @@ export async function assembleStandaloneSpk(options) {
     const { manifest } = options;
     const staging = mkdtempSync(join(tmpdir(), "syno-standalone-spk-"));
     try {
+        if (manifest.privilege === "root" && !options.authorization)
+            throw new StandaloneBuildError("AUTHORIZATION_PIN_REQUIRED", "root package requires pinned authorization bootstrap");
         const uiRoot = join(staging, "package", "ui");
         const appDir = join(uiRoot, "app");
         copyUiTree(manifest.ui.dir, appDir);
@@ -100,6 +103,15 @@ export async function assembleStandaloneSpk(options) {
         copyStandaloneNotices(manifest.root, manifest.ui.dir, join(staging, 'package'), manifest.backend.kind === 'go' || Boolean(manifest.daemon), Boolean(options.helper), manifest.integration?.identity === 'better-auth', manifest.backend.kind === 'go' ? manifest.backend.dir : undefined);
         if (manifest.daemon)
             copyFileSync(new URL('../../templates/_shared/LICENSES/TEMPLATE.txt', import.meta.url), join(staging, 'package', 'LICENSES', 'DAEMON-LICENSE.txt'));
+        if (manifest.privilege === "root") {
+            if (!options.authorization || !/^[a-f0-9]{64}$/.test(options.authorization.bootstrapSha256))
+                throw new StandaloneBuildError("AUTHORIZATION_PIN_REQUIRED", "root package requires pinned authorization bootstrap");
+            const authDir = join(staging, "package", "authorization");
+            mkdirSync(authDir);
+            copyFileSync(options.authorization.binary, join(authDir, "bootstrap"));
+            chmodSync(join(authDir, "bootstrap"), EXEC_MODE);
+            writeFile(join(authDir, "manifest.json"), JSON.stringify(authorizationPlan(options.authorization, manifest)));
+        }
         const packageTgz = join(staging, "package.tgz");
         await createReproducibleTar(join(staging, "package"), packageTgz, { gzip: true });
         rmSync(join(staging, "package"), { recursive: true, force: true });
@@ -157,6 +169,8 @@ function renderInfo(manifest, arch, checksum) {
         ["startable", "yes"],
         ["checksum", checksum],
     ];
+    if (manifest.privilege === "root")
+        fields.push(["sdk_root_authorization", "2"]);
     if (hasHelper(manifest) || manifest.daemon)
         fields.push(["precheckstartstop", "yes"]);
     if (manifest.integration?.identity === "better-auth")

package/dist/templates/_authorization/main.go

@@ -0,0 +1,104 @@
+// CLI-owned root bootstrap: accepts only compiled fixed operations. The native
+// task copies and pins this executable before it can run with root authority.
+package main
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+)
+
+var inventoryBase64 string
+
+type inventory struct {
+	Schema     int    `json:"schema"`
+	Package    string `json:"package"`
+	Version    string `json:"version"`
+	Operations []struct {
+		Name string `json:"name"`
+		Body string `json:"body"`
+	} `json:"operations"`
+	Files []struct {
+		Path string `json:"path"`
+		Size int64  `json:"size"`
+		Hash string `json:"sha256"`
+	} `json:"files"`
+}
+
+func run(args []string) error {
+	if os.Geteuid() != 0 || len(args) != 1 {
+		return errors.New("root and one fixed operation required")
+	}
+	var i inventory
+	raw, decode := base64.StdEncoding.DecodeString(inventoryBase64)
+	if decode != nil || json.Unmarshal(raw, &i) != nil || i.Schema != 2 || len(i.Operations) == 0 {
+		return errors.New("invalid compiled inventory")
+	}
+	var body string
+	for _, op := range i.Operations {
+		if op.Name == args[0] {
+			body = op.Body
+		}
+	}
+	if body == "" {
+		return errors.New("unknown operation")
+	}
+	// Disable/teardown/repair retain an escape path when UI payload is corrupt;
+	// they still execute only compiled, hash-pinned cleanup code.
+	cleanup := args[0] == "helper_disable" || args[0] == "helper_teardown" || args[0] == "helper_repair" || args[0] == "helper_purge"
+	if !cleanup {
+		if e := verifyFiles("/var/packages/"+i.Package+"/target", raw); e != nil {
+			return e
+		}
+	}
+	cmd := exec.Command("/bin/sh", "-eu", "-c", body)
+	cmd.Env = []string{"PATH=/usr/sbin:/usr/bin:/sbin:/bin"}
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+func verifyFiles(dir string, raw []byte) error {
+	var i inventory
+	if json.Unmarshal(raw, &i) != nil || i.Schema != 2 {
+		return errors.New("invalid inventory")
+	}
+	root, e := os.OpenRoot(dir)
+	if e != nil {
+		return e
+	}
+	defer root.Close()
+	for _, p := range i.Files {
+		if p.Size < 0 || p.Size > 64<<20 {
+			return errors.New("invalid size")
+		}
+		f, e := root.Open(p.Path)
+		if e != nil {
+			return e
+		}
+		st, e := f.Stat()
+		if e != nil || !st.Mode().IsRegular() || st.Size() != p.Size {
+			f.Close()
+			return errors.New("untrusted payload")
+		}
+		h := sha256.New()
+		_, e = io.Copy(h, io.LimitReader(f, p.Size+1))
+		f.Close()
+		if e != nil || hex.EncodeToString(h.Sum(nil)) != p.Hash {
+			return errors.New("untrusted payload")
+		}
+	}
+	return nil
+}
+
+func main() {
+	if e := run(os.Args[1:]); e != nil {
+		fmt.Fprintln(os.Stderr, "authorization bootstrap refused:", e)
+		os.Exit(1)
+	}
+}

package/dist/templates/_authorization/main_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestInventoryRejectsReplacementAndSymlinkEscape(t *testing.T) {
+	dir := t.TempDir()
+	body := []byte("approved bytes")
+	os.WriteFile(filepath.Join(dir, "file"), body, 0600)
+	raw := fmt.Sprintf(`{"schema":2,"files":[{"path":"file","size":%d,"sha256":"%x"}]}`, len(body), sha256.Sum256(body))
+	if e := verifyFiles(dir, []byte(raw)); e != nil {
+		t.Fatal(e)
+	}
+	os.WriteFile(filepath.Join(dir, "file"), []byte("altered bytes!"), 0600)
+	if e := verifyFiles(dir, []byte(raw)); e == nil {
+		t.Fatal("accepted replacement")
+	}
+	os.Remove(filepath.Join(dir, "file"))
+	outside := filepath.Join(t.TempDir(), "file")
+	os.WriteFile(outside, body, 0600)
+	os.Symlink(outside, filepath.Join(dir, "file"))
+	if e := verifyFiles(dir, []byte(raw)); e == nil {
+		t.Fatal("accepted external symlink")
+	}
+}
+func TestUnknownOperationNeverRuns(t *testing.T) {
+	if e := run([]string{"arbitrary"}); e == nil {
+		t.Fatal("accepted unknown operation")
+	}
+}

package/dist/templates/native-go/README.md

@@ -39,7 +39,7 @@ greeting in the package's data folder.
 | `ui/app.js`, `ui/app.css` | The app inside the DSM window | Yes — your UI |
 | `ui/…` | Any other assets; served from `/webman/3rdparty/__PACKAGE__/app/` | Yes |
 | `i18n/messages/<locale>.json` | UI text in nine languages | Yes |
-| `i18n/glossary.json` | Synology's official DSM terms, and which messages must use them | Add terms |
+| `i18n/glossary.json` | DSM's own UI terms, and which messages must use them | Add terms |
 | `backend/internal/app/` | Your API: routes and handlers | Yes — your backend |
 | `backend/internal/api/` | The CGI front door: guards, auth order, route policies | Rarely |
 | `backend/internal/dsm/` | DSM session check and administrators lookup | Rarely |
@@ -411,3 +411,27 @@ drive the same flow from its own UI.
 | Target CPUs | x86_64 and aarch64 DSM models (one SPK each) |
 | DSM | 7.1 or later declared (`os_min_ver`, change it with `init --min-dsm` or `build-spk --min-dsm`). Installed and tested on DSM 7.4 (x86_64). aarch64 SPKs are built the same way but have not been run on a NAS. |
 | Not supported | 32-bit ARM, DSM 6, running anything as root without an administrator's approval |
+
+### Shared root authorization (explicit opt-in)
+
+`init -t native-go --privilege root` adds `authorization.status`,
+`authorization.request` and `authorization.revoke` to the same package CGI URL.
+The Vue shell includes a centered authorization gate. Request/revoke return fixed
+plans; the host completes DSM PasswordConfirm/scheduler operations and reads status
+back before showing success. No password is sent to the package CGI.
+
+Each root SPK contains a SHA-256-pinned `authorization/bootstrap` and a v2 build
+inventory. The disabled native task copies bootstrap into a root-private directory
+and verifies the copied bytes before running a compiled fixed operation. The
+bootstrap verifies UI build hashes; helper control scripts retain their helper pins.
+Changing root code, helper or UI requires rebuilding and fresh authorization.
+`inspect --spk` checks bootstrap/CGI/window/inventory bindings; missing pins fail.
+The default `privilege: none` has no bootstrap or authorization routes, and all
+lifecycle scripts and CGI continue to use the package account.
+
+Before upgrading a helper integration, revoke/disable its current grant and verify
+cleanup. The existing pre-upgrade guard refuses a live helper; a new build never
+activates root automatically. Plain UI keeps its per-operation result controls.
+A non-Go prebuilt CGI must implement its own adapter and cannot use this generated
+root authorization contract. Native-layout products such as Reclaim retain their
+own privileged runtime until they explicitly migrate their adapters.

package/dist/templates/native-go/backend/cmd/app/main.go

@@ -22,9 +22,10 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	packageID       = "dev"
-	version         = "0.0.0"
-	helperInventory = ""
+	rootAuthorization = ""
+	packageID         = "dev"
+	version           = "0.0.0"
+	helperInventory   = ""
 	// "package" when the project has an integration but no privileged helper.
 	integrationMode = ""
 	// "session" when the project opted into the interactive File Station adapter.
@@ -39,9 +40,10 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		PackageID: packageID,
-		Version:   version,
-		DataDir:   "/var/packages/" + packageID + "/var",
+		RootAuthorization: rootAuthorization,
+		PackageID:         packageID,
+		Version:           version,
+		DataDir:           "/var/packages/" + packageID + "/var",
 
 		PackageIntegration: integrationMode == "package",
 	}

package/dist/templates/native-go/backend/cmd/app/sdk_main.go

@@ -20,9 +20,10 @@ import (
 
 // Set by `synopkgland build-spk` through -ldflags -X; never read from a request.
 var (
-	packageID       = "dev"
-	version         = "0.0.0"
-	helperInventory = ""
+	rootAuthorization = ""
+	packageID         = "dev"
+	version           = "0.0.0"
+	helperInventory   = ""
 	// "session" when the project opted into the interactive File Station adapter.
 	fileStation = ""
 )
@@ -35,9 +36,10 @@ func main() {
 		os.Exit(2)
 	}
 	cfg := app.Config{
-		PackageID: packageID,
-		Version:   version,
-		DataDir:   "/var/packages/" + packageID + "/var",
+		RootAuthorization: rootAuthorization,
+		PackageID:         packageID,
+		Version:           version,
+		DataDir:           "/var/packages/" + packageID + "/var",
 	}
 	if helperInventory != "" {
 		if json.Unmarshal([]byte(helperInventory), &cfg.HelperInventory) != nil || cfg.HelperInventory.Package != packageID || cfg.HelperInventory.Version != version {

package/dist/templates/native-go/backend/cmd/helper/main.go

@@ -16,7 +16,7 @@ func main() {
 	if len(os.Args) != 2 || json.Unmarshal([]byte(helperInventory), &i) != nil {
 		os.Exit(2)
 	}
-	if os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
+	if os.Args[1] == "revoke" || os.Args[1] == "check-stopped" || os.Args[1] == "diagnose" || os.Args[1] == "diagnose-startup" {
 		c, err := helper.LocalClient(i)
 		if err != nil {
 			os.Exit(1)
@@ -34,11 +34,28 @@ func main() {
 			json.NewEncoder(os.Stdout).Encode(c.Status(context.Background()))
 			return
 		}
+		if os.Args[1] == "revoke" {
+			if c.Revoke(context.Background()) != nil {
+				os.Exit(1)
+			}
+			return
+		}
 		if c.CheckStopped(context.Background()) != nil {
 			os.Exit(1)
 		}
 		return
 	}
+	if os.Args[1] == "purge" {
+		if os.Geteuid() != 0 {
+			os.Exit(1)
+		}
+		c, err := helper.LocalClient(i)
+		if err != nil || c.Purge() != nil {
+			os.Exit(1)
+		}
+		fmt.Println(`{"success":true}`)
+		return
+	}
 	if err := helper.RunLinux(i, os.Args[1]); err != nil {
 		fmt.Fprintln(os.Stderr, "helper lifecycle refused")
 		os.Exit(1)

package/dist/templates/native-go/backend/internal/app/authorization_none.go

@@ -0,0 +1,5 @@
+package app
+
+import "dsmapp/internal/api"
+
+func (Config) authorizationRoutes() []api.Route { return nil }

package/dist/templates/native-go/backend/internal/app/routes.go

@@ -27,6 +27,8 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
+	RootAuthorization string
+
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles    *filestation.Service
 	PackageID       string
@@ -45,13 +47,14 @@ type Config struct {
 }
 
 func Routes(cfg Config) []api.Route {
-	routes := []api.Route{
+	routes := cfg.authorizationRoutes()
+	routes = append(routes, []api.Route{
 		api.User("integration.status", cfg.integrationStatus),
 		api.BoundedRead(cfg.binaryRead),
 		api.User("app.status", cfg.status),
 		api.User("greeting.get", cfg.getGreeting),
 		api.Admin("greeting.set", cfg.setGreeting),
-	}
+	}...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)
 	return append(routes, cfg.rootRoutes()...)

package/dist/templates/native-go/backend/internal/app/sdk_routes.go

@@ -25,6 +25,8 @@ import (
 
 // Config is fixed at build time and startup, never taken from a request.
 type Config struct {
+	RootAuthorization string
+
 	// SessionFiles is the interactive File Station adapter; nil keeps legacy refusal.
 	SessionFiles    *filestation.Service
 	SDKJobs         func(context.Context, string, helper.SessionCarriers, json.RawMessage) (json.RawMessage, helper.Code)
@@ -44,13 +46,14 @@ type Config struct {
 }
 
 func Routes(cfg Config) []api.Route {
-	routes := []api.Route{
+	routes := cfg.authorizationRoutes()
+	routes = append(routes, []api.Route{
 		api.User("integration.status", cfg.integrationStatus),
 		api.BoundedRead(cfg.binaryRead),
 		api.User("app.status", cfg.status),
 		api.User("greeting.get", cfg.getGreeting),
 		api.Admin("greeting.set", cfg.setGreeting),
-	}
+	}...)
 	routes = append(routes, cfg.sdkJobRoutes()...)
 	routes = append(routes, cfg.SessionFiles.Routes()...)
 	routes = append(routes, cfg.backgroundRoutes()...)

package/dist/templates/native-go/backend/internal/helper/management.go

@@ -16,7 +16,14 @@ import (
 // starts/signals a process. Private completion contents stay private to root.
 func (c Client) staleManagementStopped() bool {
 	r, err := readRecord(c.StateDir, c.Owner)
-	if err != nil || !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || !r.Enabled || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
+	if err != nil || !r.Enabled {
+		return false
+	}
+	return c.managementStopped(r)
+}
+
+func (c Client) managementStopped(r Record) bool {
+	if !c.Expected.Valid() || r.Inventory.Package != c.Expected.Package || r.Schema != 2 || r.Residual || r.Lifecycle == nil || r.Lifecycle.Phase != "stopped" || r.Lifecycle.Completion == "" || r.Lifecycle.Lease == nil {
 		return false
 	}
 	if !c.canonicalApproval(r) || !c.completionPublished(r) {

package/dist/templates/native-go/backend/internal/helper/purge.go

@@ -0,0 +1,115 @@
+package helper
+
+import (
+	"io/fs"
+	"os"
+	"path/filepath"
+	"regexp"
+	"syscall"
+)
+
+var terminalFile = regexp.MustCompile(`^(completion-[a-f0-9]{64}\.json|lifetime-[a-f0-9]{64}\.lock)$`)
+var cachedPayload = regexp.MustCompile(`^payload-[a-f0-9]{64}$`)
+
+// Purge is a separate fixed, administrator-approved operation. Never expose
+// deletion through the package socket. Unknown files (including data/grants)
+// are retained and cause refusal; only terminal lifecycle metadata is removed.
+func (c Client) Purge() error {
+	r, err := readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	locks := []*os.File{}
+	defer func() {
+		for _, f := range locks {
+			f.Close()
+		}
+	}()
+	lock := func(name string) error {
+		f, err := os.OpenFile(filepath.Join(c.StateDir, name), os.O_CREATE|os.O_RDWR|syscall.O_NOFOLLOW, 0600)
+		if err != nil {
+			return err
+		}
+		locks = append(locks, f)
+		if err := protected(f.Name(), c.Owner, false); err != nil {
+			return err
+		}
+		if syscall.Flock(int(f.Fd()), syscall.LOCK_EX|syscall.LOCK_NB) != nil {
+			return errBusy
+		}
+		return nil
+	}
+	for _, name := range []string{"control.lock", "policy.lock"} {
+		if err := lock(name); err != nil {
+			return err
+		}
+	}
+	// Recheck after serialization against enable and the terminal publisher.
+	r, err = readRecord(c.StateDir, c.Owner)
+	if err != nil || r.Enabled || r.Inventory != c.Expected || !c.managementStopped(r) {
+		return errTrust
+	}
+	entries, err := os.ReadDir(c.StateDir)
+	if err != nil || len(entries) > 512 {
+		return errTrust
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		mode := fs.FileMode(0600)
+		switch {
+		case name == "approval.json":
+			mode = 0644
+		case cachedPayload.MatchString(name):
+			mode = 0700
+		case terminalFile.MatchString(name), name == "control.lock", name == "policy.lock", name == "observer-diagnostic.json":
+		default:
+			return errTrust
+		}
+		st, err := os.Lstat(filepath.Join(c.StateDir, name))
+		if err != nil {
+			return err
+		}
+		stat, ok := st.Sys().(*syscall.Stat_t)
+		if !ok || !st.Mode().IsRegular() || st.Mode().Perm() != mode || stat.Uid != c.Owner || stat.Nlink != 1 {
+			return errTrust
+		}
+		if filepath.Ext(name) == ".lock" && name != "control.lock" && name != "policy.lock" {
+			if err := lock(name); err != nil {
+				return err
+			}
+		}
+	}
+	// No recursive removal. A socket/process/foreign file prevents all deletion.
+	if err := protected(c.RunDir, c.Owner, true); err != nil {
+		return err
+	}
+	runtime, err := os.ReadDir(c.RunDir)
+	if err != nil || len(runtime) != 0 {
+		return errTrust
+	}
+	// If an I/O failure interrupts cleanup, retain a durable disabled gate and
+	// cleanup-required diagnostic. Remove that record only after other files.
+	r.Residual = true
+	if err := writeProtected(c.StateDir, "approval.json", r); err != nil {
+		return err
+	}
+	for _, entry := range entries {
+		if entry.Name() == "approval.json" {
+			continue
+		}
+		if err := os.Remove(filepath.Join(c.StateDir, entry.Name())); err != nil {
+			return err
+		}
+	}
+	if err := os.Remove(c.RunDir); err != nil {
+		return err
+	}
+	if err := os.Remove(filepath.Join(c.StateDir, "approval.json")); err != nil {
+		return err
+	}
+	if err := os.Remove(c.StateDir); err != nil {
+		_ = writeProtected(c.StateDir, "approval.json", r)
+		return err
+	}
+	return nil
+}

package/dist/templates/native-go/backend/internal/helper/purge_test.go

@@ -0,0 +1,59 @@
+package helper
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func terminalPurgeFixture(t *testing.T) Client {
+	c, f := controlFixture(t)
+	l := testLifecycle("fenced")
+	if err := createLifetime(c.Client, l); err != nil {
+		t.Fatal(err)
+	}
+	record(t, c.Client, Record{Schema: 2, Inventory: c.Expected, Enabled: false, Residual: true, Lifecycle: l})
+	if err := cleanRuntime(c.Client, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := completeRecord(c.Client, l.Epoch, f.current); err != nil {
+		t.Fatal(err)
+	}
+	return c.Client
+}
+func TestPurgeRemovesOnlyVerifiedDisabledTerminalState(t *testing.T) {
+	c := terminalPurgeFixture(t)
+	if err := c.Purge(); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{c.StateDir, c.RunDir} {
+		if _, err := os.Lstat(path); !os.IsNotExist(err) {
+			t.Fatalf("residue %s: %v", path, err)
+		}
+	}
+}
+func TestPurgeRefusesLiveStateUnknownEntriesAndLinks(t *testing.T) {
+	for _, which := range []string{"live", "unknown", "link", "proof"} {
+		t.Run(which, func(t *testing.T) {
+			c := terminalPurgeFixture(t)
+			switch which {
+			case "live":
+				r, _ := readRecord(c.StateDir, c.Owner)
+				r.Enabled = true
+				record(t, c, r)
+			case "unknown":
+				os.WriteFile(filepath.Join(c.StateDir, "user-data"), []byte("retain"), 0600)
+			case "link":
+				os.Symlink("/etc/passwd", filepath.Join(c.StateDir, "payload-"+c.Expected.PayloadDigest))
+			case "proof":
+				os.Remove(filepath.Join(c.StateDir, "completion-"+testLifecycle("stopped").Epoch+".json"))
+			}
+			if c.Purge() == nil {
+				t.Fatal("unsafe purge accepted")
+			}
+			if _, err := os.Stat(filepath.Join(c.StateDir, "approval.json")); err != nil {
+				t.Fatal("refusal deleted approval")
+			}
+		})
+	}
+}