@timurproko/a1 0.1.8-dev.299 → 0.1.8-dev.332

package/dist/foundation/release/dependency-layer.d.ts

@@ -1,3 +1,5 @@
+import { type ReadDependencyCertificationOptions } from "./dependency-certification.js";
+export { dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath } from "./dependency-certification.js";
 import { type ReleaseFileIdentity } from "./release.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export declare const DEPENDENCY_LAYER_SCHEMA: string;
@@ -37,9 +39,7 @@ export interface DependencyLayerOperationEvent {
     readonly path: string;
     readonly bytes: number;
 }
-export interface ReadCertifiedDependencyLayerOptions {
-    /** Accept and replace certification written by the immediately preceding updater format. */
-    readonly allowLegacyParentCertification?: boolean;
+export interface ReadCertifiedDependencyLayerOptions extends ReadDependencyCertificationOptions {
 }
 export interface SelectedRuntimePayload {
     readonly paths: readonly string[];
@@ -79,4 +79,3 @@ export declare function readCertifiedDependencyLayer(dataDir: string, layerId: s
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */
 export declare function verifyDependencyLayer(dataDir: string, reference: DependencyLayerReference, onOperation?: (event: DependencyLayerOperationEvent) => void): Promise<Omit<MaterializedDependencyLayer, "reused">>;
 export declare function dependencyReference(layer: MaterializedDependencyLayer): DependencyLayerReference;
-export declare function dependencyLayerCertificationPath(dataDir: string, layerId: string): string;

package/dist/foundation/release/dependency-layer.js

@@ -2,7 +2,9 @@ import { randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, posix, relative, resolve, sep } from "node:path";
 import { mapWithConcurrency } from "./concurrency.js";
-import { assertImmutableFileMode, immutablePlatformPolicy } from "./immutable-platform.js";
+import { assertImmutableFileMode } from "./immutable-platform.js";
+import { readDependencyCertification, writeDependencyCertification as writeLayerCertification } from "./dependency-certification.js";
+export { dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath } from "./dependency-certification.js";
 import { digestManifestFiles, releaseFileIdentity, resolveWithin } from "./release.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 const LAYER_IO_CONCURRENCY = 32;
@@ -281,20 +283,9 @@ export async function readCertifiedDependencyLayer(dataDir, layerId, expected, o
     if (expected && (expected.layerId !== manifest.layerId || expected.contentDigest !== manifest.contentDigest)) {
         throw new Error(`dependency layer identity mismatch: ${layerId}`);
     }
-    const certification = JSON.parse(await readFile(certificationPath(dataDir, layerId), "utf8"));
-    const identityMatches = certification.schema === PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema
-        && certification.layerId === manifest.layerId && certification.contentDigest === manifest.contentDigest;
-    const currentPlatformEvidence = certification.platform === process.platform && certification.platformPolicy === immutablePlatformPolicy();
-    // Compatibility: the updater that introduced layers certified these exact identities but did
-    // not record platform fields. Only an authenticated parent-started supervisor opts into this
-    // transition; durable/reuse readers remain strict and cannot treat the legacy marker as authority.
-    const legacyParentCertification = options.allowLegacyParentCertification === true
-        && certification.platform === undefined && certification.platformPolicy === undefined;
-    if (!identityMatches || (!currentPlatformEvidence && !legacyParentCertification)) {
-        throw new Error(`dependency layer certification differs from manifest: ${layerId}`);
-    }
-    if (legacyParentCertification)
-        await writeLayerCertification(dataDir, manifest);
+    if (manifest.layerId !== layerId)
+        throw new Error(`dependency layer identity mismatch: ${layerId}`);
+    await readDependencyCertification(dataDir, manifest, options);
     return { ...manifest, layerRoot };
 }
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */
@@ -326,12 +317,6 @@ export async function verifyDependencyLayer(dataDir, reference, onOperation) {
 export function dependencyReference(layer) {
     return { layerId: layer.layerId, contentDigest: layer.contentDigest, binding: "node_modules" };
 }
-export function dependencyLayerCertificationPath(dataDir, layerId) {
-    return certificationPath(dataDir, layerId);
-}
-function certificationPath(dataDir, layerId) {
-    return resolve(dataDir, `dependency-layer-certification-${layerId}.json`);
-}
 async function reuseDependencyLayer(dataDir, identity) {
     try {
         return await readCertifiedDependencyLayer(dataDir, identity.layerId, identity);
@@ -343,22 +328,6 @@ async function reuseDependencyLayer(dataDir, identity) {
         return verified;
     }
 }
-async function writeLayerCertification(dataDir, identity) {
-    const path = certificationPath(dataDir, identity.layerId);
-    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-    await writeFile(temporary, JSON.stringify({
-        schema: PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema,
-        layerId: identity.layerId,
-        contentDigest: identity.contentDigest,
-        platform: process.platform,
-        platformPolicy: immutablePlatformPolicy(),
-        certifiedAt: new Date().toISOString(),
-    }, null, 2), { flag: "wx", mode: 0o400 });
-    await chmod(path, 0o600).catch(() => { });
-    await rm(path, { force: true });
-    await rename(temporary, path);
-    await chmod(path, 0o400);
-}
 function validateLayerManifest(value) {
     if (value.schema !== DEPENDENCY_LAYER_SCHEMA || !/^dependencies-[a-f0-9]{32}$/.test(value.layerId)
         || !/^[a-f0-9]{64}$/.test(value.contentDigest) || !Array.isArray(value.files) || value.files.length === 0

package/dist/foundation/release/release-gc.js

@@ -7,7 +7,9 @@ import { CohortStateStore, planProtectedReleases, } from "./cohort-state.js";
 import { liveReleaseIds } from "./endpoints.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
-import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath } from "./dependency-layer.js";
+import { DEPENDENCY_LAYER_MANIFEST, readCertifiedDependencyLayer } from "./dependency-layer.js";
+import { dependencyCertificationDirectory, managedDependencyCertificationPath } from "./dependency-certification.js";
+import { dependencyCertificationProtection } from "./dependency-certification-retention.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 import { cleanupUpdateRecoveryCapsules } from "./update-recovery.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
@@ -17,8 +19,8 @@ const DEFAULT_LIMITS = { maxItems: 8, maxDurationMs: 2_000, concurrency: 1 };
 const DEFAULT_WORKER_DURATION_MS = 10 * 60 * 1_000;
 const DEFAULT_NO_PROGRESS_BATCHES = 5;
 const DEFAULT_RETRY_DELAY_MS = 500;
-const WORKER_HOLDS_ENV = "A1_RELEASE_CLEANUP_HOLDS";
-const WORKER_RUN_ID_ENV = "A1_RELEASE_CLEANUP_RUN_ID";
+const WORKER_HOLDS_ENV = "RELEASE_CLEANUP_HOLDS";
+const WORKER_RUN_ID_ENV = "RELEASE_CLEANUP_RUN_ID";
 const WORKER_LEASE_FILENAME = "release-cleanup-worker.lock";
 /**
  * Reconcile current ownership under the cohort-state lock and durably detach obsolete releases.
@@ -483,13 +485,19 @@ async function removeAbandonedArtifact(dataDir, path, operations) {
     throw new Error("abandoned artifact is outside managed candidate, trash, or certification paths");
 }
 async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, options) {
+    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
+    if ((await transactionStore.read())?.status === "active")
+        return { attempted: 0, completed: 0 };
+    const protection = await dependencyCertificationProtection(dataDir, Object.keys((await store.read()).releases));
+    if (protection.uncertain)
+        return { attempted: 0, completed: 0 };
+    const { referenced } = protection;
     const layersRoot = resolve(dataDir, "dependency-layers");
     const layersMetadata = await lstat(layersRoot).catch(error => missingOrThrow(error));
     if (layersMetadata === null)
-        return { attempted: 0, completed: 0 };
+        return await collectDependencyCertificationRecords(store, dataDir, protection, maxItems, options);
     if (!layersMetadata.isDirectory() || layersMetadata.isSymbolicLink())
         throw new Error("dependency-layer store is not a managed directory");
-    const referenced = await referencedDependencyLayerIds(dataDir);
     const trashRoot = resolve(layersRoot, ".trash");
     await mkdir(trashRoot, { recursive: true, mode: 0o700 });
     let attempted = 0;
@@ -514,7 +522,12 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
     for (const entry of await readdir(trashRoot, { withFileTypes: true })) {
         candidates.push({ path: resolve(trashRoot, entry.name), layerId: entry.name.split("--", 1)[0] ?? null, inTrash: true });
     }
-    for (const candidate of candidates.slice(0, maxItems)) {
+    const certificates = await collectDependencyCertificationRecords(store, dataDir, protection, Math.min(1, maxItems), options);
+    attempted += certificates.attempted;
+    completed += certificates.completed;
+    for (const candidate of candidates.slice(0, maxItems - attempted)) {
+        if ((await transactionStore.read())?.status === "active")
+            break;
         if (candidate.layerId !== null && referenced.has(candidate.layerId))
             continue;
         attempted += 1;
@@ -541,7 +554,11 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
             }
             await (options.operations?.remove ?? rm)(removalPath, { recursive: true, force: false, maxRetries: 0 });
             if (candidate.layerId !== null && /^dependencies-[a-f0-9]{32}$/.test(candidate.layerId)) {
-                await rm(dependencyLayerCertificationPath(dataDir, candidate.layerId), { force: true });
+                for (const legacy of [false, true]) {
+                    const certificate = await managedDependencyCertificationPath(dataDir, candidate.layerId, legacy);
+                    if (certificate !== null)
+                        await (options.operations?.remove ?? rm)(certificate, { force: true });
+                }
             }
             completed += 1;
         }
@@ -551,22 +568,58 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
         }
     }
     if (attempted < maxItems) {
-        for (const entry of await readdir(dataDir, { withFileTypes: true })) {
-            const match = /^dependency-layer-certification-(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
-            if (!match || !entry.isFile() || referenced.has(match[1]))
-                continue;
-            if (await lstat(resolve(layersRoot, match[1])).catch(error => missingOrThrow(error)) !== null)
-                continue;
-            attempted += 1;
-            try {
-                await (options.operations?.remove ?? rm)(resolve(dataDir, entry.name), { force: true });
-                completed += 1;
+        const remaining = await collectDependencyCertificationRecords(store, dataDir, protection, maxItems - attempted, options);
+        attempted += remaining.attempted;
+        completed += remaining.completed;
+    }
+    return { attempted, completed };
+}
+async function collectDependencyCertificationRecords(store, dataDir, protection, maxItems, options) {
+    const candidates = new Map();
+    for (const entry of await readdir(dataDir, { withFileTypes: true })) {
+        const match = /^dependency-layer-certification-(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
+        if (match && entry.isFile())
+            candidates.set(resolve(dataDir, entry.name), { layerId: match[1], legacy: true });
+    }
+    try {
+        const directory = await dependencyCertificationDirectory(dataDir);
+        if (directory !== null) {
+            for (const entry of await readdir(directory, { withFileTypes: true })) {
+                const match = /^(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
+                if (match && entry.isFile())
+                    candidates.set(resolve(directory, entry.name), { layerId: match[1], legacy: false });
             }
-            catch (error) {
-                await store.recordCleanupFailure(match[1], "dependency-layer-certification", error);
+        }
+    }
+    catch (error) {
+        await store.recordCleanupFailure("dependency-certifications", "certification-discovery", error);
+        return { attempted: 0, completed: 0 };
+    }
+    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
+    let attempted = 0;
+    let completed = 0;
+    for (const candidate of sortArtifacts([...candidates.keys()], await store.read())) {
+        if (attempted >= maxItems || (await transactionStore.read())?.status === "active")
+            break;
+        const { layerId, legacy } = candidates.get(candidate);
+        if (legacy ? protection.legacyRequired.has(layerId) : protection.referenced.has(layerId))
+            continue;
+        const layerExists = await lstat(resolve(dataDir, "dependency-layers", layerId)).catch(missingOrThrow) !== null;
+        if (!legacy && layerExists)
+            continue;
+        try {
+            if (legacy && (layerExists || protection.referenced.has(layerId))) {
+                // Security: a duplicate is disposable only with validated canonical evidence, never fallback.
+                await readCertifiedDependencyLayer(dataDir, layerId, undefined, { canonicalOnly: true });
             }
-            if (attempted >= maxItems)
-                break;
+            attempted += 1;
+            const path = await managedDependencyCertificationPath(dataDir, layerId, legacy);
+            if (path !== null)
+                await (options.operations?.remove ?? rm)(path, { force: true });
+            completed += 1;
+        }
+        catch (error) {
+            await store.recordCleanupFailure(artifactName(candidate), "dependency-layer-certification", error);
         }
     }
     return { attempted, completed };
@@ -585,31 +638,6 @@ async function protectedCompileCachePaths(dataDir, state) {
     }
     return paths;
 }
-async function referencedDependencyLayerIds(dataDir) {
-    const referenced = new Set();
-    const releasesRoot = resolve(dataDir, "releases");
-    const roots = [];
-    for (const entry of await readdir(releasesRoot, { withFileTypes: true }).catch(() => [])) {
-        if (entry.name === ".trash") {
-            for (const trash of await readdir(resolve(releasesRoot, entry.name), { withFileTypes: true }).catch(() => [])) {
-                if (trash.isDirectory())
-                    roots.push(resolve(releasesRoot, entry.name, trash.name));
-            }
-        }
-        else if (entry.isDirectory() && !entry.name.startsWith(".candidate-"))
-            roots.push(resolve(releasesRoot, entry.name));
-    }
-    for (const root of roots) {
-        try {
-            const manifest = JSON.parse(await readFile(resolve(root, RELEASE_MANIFEST_FILENAME), "utf8"));
-            for (const layer of manifest.dependencyLayers ?? [])
-                if (typeof layer.layerId === "string")
-                    referenced.add(layer.layerId);
-        }
-        catch { }
-    }
-    return referenced;
-}
 function assertDirectChild(parent, child) {
     const fromParent = relative(parent, child);
     if (fromParent.length === 0 || fromParent === ".." || fromParent.startsWith(`..${sep}`) || isAbsolute(fromParent) || fromParent.includes(sep)) {

package/dist/foundation/release/release-store.d.ts

@@ -28,6 +28,8 @@ export interface CertifiedReleaseRecord {
     readonly releaseRoot: string;
     readonly packageVersion?: string;
     readonly contentDigest: string;
+    /** Absent on records written before releases declared a handoff contract. */
+    readonly launchContract?: string;
 }
 /** Process-authority compatibility controls for metadata-only release loading. */
 export type ReadCertifiedReleaseManifestOptions = ReadCertifiedDependencyLayerOptions;

package/dist/foundation/release/release-store.js

@@ -3,6 +3,7 @@ import { chmod, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_PACKAGE_NAME, createReleaseIdentity, discoverReleasePayload, releaseFileIdentity, resolveWithin, } from "./release.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
+import { assertCurrentLaunchContract, isCurrentLaunchContract, readLaunchContext } from "../launch-context/index.js";
 import { mapWithConcurrency } from "./concurrency.js";
 import { assertImmutableFileMode } from "./immutable-platform.js";
 import { dependencyReference, materializeDependencyLayer, readCertifiedDependencyLayer, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
@@ -13,6 +14,7 @@ export async function materializeRelease(packageRoot, dataDir, options = {}) {
     const payload = await discoverReleasePayload(packageRoot, {
         onSourceRead: (path, bytes) => options.onOperation?.({ operation: "source-read", path, bytes }),
     });
+    assertCurrentLaunchContract(payload);
     const storeRoot = resolve(dataDir, "releases");
     await mkdir(storeRoot, { recursive: true, mode: 0o700 });
     const dependencyPaths = payload.paths.filter(path => path.startsWith("node_modules/"));
@@ -60,7 +62,7 @@ export async function materializeRelease(packageRoot, dataDir, options = {}) {
             options.onOperation?.({ operation: "candidate-write", path, bytes: bytes.length });
             return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
         });
-        const identity = createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, layerReferences);
+        const identity = createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, layerReferences, payload.launchContract);
         if (layer !== null) {
             const binding = resolveWithin(candidate, "node_modules");
             const target = resolveWithin(layer.layerRoot, "node_modules");
@@ -137,7 +139,7 @@ export async function verifyMaterializedRelease(releaseRoot, expected, selectedS
     await mapWithConcurrency(manifest.files, RELEASE_FILE_IO_CONCURRENCY, async (file) => {
         await verifyFile(canonical, file, options);
     });
-    const recomputed = createReleaseIdentity(manifest.packageRoot, manifest.packageVersion, manifest.files, manifest.dependencyLayers ?? []).contentDigest;
+    const recomputed = createReleaseIdentity(manifest.packageRoot, manifest.packageVersion, manifest.files, manifest.dependencyLayers ?? [], manifest.launchContract).contentDigest;
     if (recomputed !== manifest.contentDigest)
         throw new Error(`release content digest mismatch for ${manifest.releaseId}`);
     await verifyReleaseDependencies(canonical, canonicalStoreRoot, manifest.dependencyLayers ?? [], true, options);
@@ -146,7 +148,7 @@ export async function verifyMaterializedRelease(releaseRoot, expected, selectedS
 export async function assertImmutableExecutionRoot(release, dataDir) {
     const storeRoot = await realpath(resolve(dataDir, "releases"));
     assertContained(storeRoot, release.releaseRoot, "release root is outside the selected release store");
-    const selectedRoot = process.env[PRODUCT_IDENTITY.environment.releaseRoot];
+    const selectedRoot = readLaunchContext(process.env, "release").releaseRoot;
     if (!selectedRoot)
         throw new Error(PRODUCT_TEXT.diagnostic("persistent process has no immutable release root"));
     const selected = await realpath(selectedRoot);
@@ -200,6 +202,9 @@ function certificationReadyRelease(release) {
     return release;
 }
 function validateManifest(value) {
+    if (value.launchContract !== undefined && !isCurrentLaunchContract(value)) {
+        throw new Error(PRODUCT_TEXT.diagnostic(`release manifest declares an unsupported launch contract: ${String(value.launchContract)}`));
+    }
     if (value.packageName !== PRODUCT_PACKAGE_NAME || typeof value.packageVersion !== "string")
         throw new Error(PRODUCT_TEXT.diagnostic("release manifest metadata is invalid"));
     if (!/^[a-f0-9]{64}$/.test(value.contentDigest) || !/^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/.test(value.releaseId))
@@ -218,6 +223,9 @@ function validateManifest(value) {
         if (!Number.isSafeInteger(file.bytes) || file.bytes < 0 || !/^[a-f0-9]{64}$/.test(file.sha256))
             throw new Error(`invalid release manifest file identity: ${file.path}`);
     }
+    const expected = createReleaseIdentity(value.packageRoot, value.packageVersion, value.files, value.dependencyLayers ?? [], value.launchContract);
+    if (expected.contentDigest !== value.contentDigest)
+        throw new Error("release manifest content/contract digest mismatch");
 }
 function assertContained(parent, child, message) {
     const fromParent = relative(parent, child);

package/dist/foundation/release/release.d.ts

@@ -12,6 +12,7 @@ export interface ReleaseIdentity {
     readonly contentDigest: string;
     readonly releaseId: string;
     readonly packageRoot: string;
+    readonly launchContract?: string;
     readonly files: readonly ReleaseFileIdentity[];
     /** Absent for legacy full-copy releases. */
     readonly dependencyLayers?: readonly DependencyLayerReference[];
@@ -20,6 +21,7 @@ export interface DiscoveredReleasePayload {
     readonly packageRoot: string;
     readonly packageVersion: string;
     readonly paths: readonly string[];
+    readonly launchContract?: string;
     /** Package manifests already read to discover the dependency closure. */
     readonly cachedFiles: ReadonlyMap<string, Buffer>;
 }
@@ -34,7 +36,7 @@ export declare function discoverReleasePayload(packageRoot: string, options?: Di
  * content.
  */
 export declare function deriveReleaseIdentity(packageRoot: string): Promise<ReleaseIdentity>;
-export declare function createReleaseIdentity(packageRoot: string, packageVersion: string, files: readonly ReleaseFileIdentity[], dependencyLayers?: readonly DependencyLayerReference[]): ReleaseIdentity;
+export declare function createReleaseIdentity(packageRoot: string, packageVersion: string, files: readonly ReleaseFileIdentity[], dependencyLayers?: readonly DependencyLayerReference[], launchContract?: string): ReleaseIdentity;
 export declare function releaseFileIdentity(path: string, bytes: Uint8Array, executable: boolean): ReleaseFileIdentity;
 export declare function digestManifestFiles(files: readonly ReleaseFileIdentity[]): string;
 export declare function resolveWithin(root: string, candidate: string): string;

package/dist/foundation/release/release.js

@@ -31,6 +31,7 @@ export async function discoverReleasePayload(packageRoot, options = {}) {
         packageRoot: canonicalRoot,
         packageVersion: manifest.version,
         paths: [...paths].sort(),
+        ...(typeof manifest.privateLaunchContract === "string" ? { launchContract: manifest.privateLaunchContract } : {}),
         cachedFiles,
     };
 }
@@ -49,10 +50,12 @@ export async function deriveReleaseIdentity(packageRoot) {
         const bytes = payload.cachedFiles.get(path) ?? await readFile(absolute);
         return releaseFileIdentity(path, bytes, (metadata.mode & 0o111) !== 0);
     });
-    return createReleaseIdentity(payload.packageRoot, payload.packageVersion, files);
+    return createReleaseIdentity(payload.packageRoot, payload.packageVersion, files, [], payload.launchContract);
 }
-export function createReleaseIdentity(packageRoot, packageVersion, files, dependencyLayers = []) {
-    const productDigest = digestManifestFiles(files);
+export function createReleaseIdentity(packageRoot, packageVersion, files, dependencyLayers = [], launchContract) {
+    const fileDigest = digestManifestFiles(files);
+    const productDigest = launchContract === undefined ? fileDigest
+        : createHash("sha256").update(`launch-contract\0${launchContract}\0${fileDigest}`).digest("hex");
     const contentDigest = dependencyLayers.length === 0
         ? productDigest
         : createHash("sha256")
@@ -65,6 +68,7 @@ export function createReleaseIdentity(packageRoot, packageVersion, files, depend
         contentDigest,
         releaseId: `${packageVersion}-${contentDigest.slice(0, 20)}`,
         packageRoot,
+        ...(launchContract === undefined ? {} : { launchContract }),
         files: [...files].sort(compareReleaseFiles),
         ...(dependencyLayers.length === 0 ? {} : { dependencyLayers: [...dependencyLayers] }),
     };

package/dist/foundation/release/restart-certification.d.ts

@@ -25,6 +25,7 @@ interface LayerRestartEvidence extends DependencyLayerReference {
 }
 interface RestartSealCore {
     readonly version: typeof RESTART_SEAL_VERSION;
+    readonly launchContract: string;
     readonly platform: NodeJS.Platform;
     readonly platformPolicy: ImmutablePlatformPolicy;
     readonly releaseId: string;

package/dist/foundation/release/restart-certification.js

@@ -2,7 +2,9 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, realpath, stat } from "node:fs/promises";
 import { basename, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath } from "./dependency-layer.js";
+import { PRIVATE_LAUNCH_CONTRACT, launchContractTarget } from "../launch-context/index.js";
+import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath, readCertifiedDependencyLayer } from "./dependency-layer.js";
+import { managedDependencyCertificationPath } from "./dependency-certification.js";
 import { immutablePlatformPolicy } from "./immutable-platform.js";
 import { PRODUCT_PACKAGE_NAME } from "./release.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
@@ -27,6 +29,7 @@ export async function createRestartSeal(release, dataDir) {
     const dependencyLayers = await Promise.all((release.dependencyLayers ?? []).map(async (reference) => {
         if (layersRoot === null)
             throw new Error("restart certification has no dependency-layer root");
+        await readCertifiedDependencyLayer(canonicalData, reference.layerId, reference);
         const layerRoot = await realpath(resolve(layersRoot, reference.layerId));
         assertDirectChild(layersRoot, layerRoot, reference.layerId, "dependency layer");
         const bindingPath = resolve(releaseRoot, reference.binding);
@@ -45,6 +48,7 @@ export async function createRestartSeal(release, dataDir) {
     }));
     const core = {
         version: RESTART_SEAL_VERSION,
+        launchContract: launchContractTarget(release),
         platform: process.platform,
         platformPolicy: policy,
         releaseId: release.releaseId,
@@ -81,6 +85,11 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
         throw new Error("restart certification differs from the approved release record");
     }
     const seal = normalizeRestartSeal(certification.restartSeal);
+    // Invariant: a seal is restart authority only for a handoff this build can still
+    // perform, which is the contract it emits or the pre-cutover one it retains.
+    if (seal.launchContract !== PRIVATE_LAUNCH_CONTRACT && seal.launchContract !== "superseded") {
+        throw new Error(`restart seal declares an unsupported launch contract: ${String(seal.launchContract)}`);
+    }
     if (seal.platform !== process.platform || seal.platformPolicy !== immutablePlatformPolicy()) {
         throw new Error("restart certification platform immutability evidence is unsupported");
     }
@@ -119,6 +128,12 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
         assertDirectChild(layersRoot, layerRoot, layer.layerId, "dependency layer");
         await assertPathEvidence(layer.layerRoot, onEvent);
         await assertPathEvidence(layer.manifest, onEvent);
+        const legacyPath = legacyDependencyLayerCertificationPath(canonicalData, layer.layerId);
+        const canonicalPath = dependencyLayerCertificationPath(canonicalData, layer.layerId);
+        if (layer.certification.path !== legacyPath && layer.certification.path !== canonicalPath) {
+            throw new Error("restart dependency certification path is outside managed storage");
+        }
+        await managedDependencyCertificationPath(canonicalData, layer.layerId, layer.certification.path === legacyPath);
         await assertPathEvidence(layer.certification, onEvent);
         await assertPathEvidence(layer.bindingEvidence, onEvent, true);
         const bindingTarget = await observedRealpath(layer.bindingEvidence.path, onEvent);
@@ -129,6 +144,7 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
     }
     return {
         packageName: PRODUCT_PACKAGE_NAME,
+        launchContract: seal.launchContract,
         packageVersion: seal.packageVersion,
         contentDigest: seal.contentDigest,
         releaseId: seal.releaseId,

package/dist/foundation/release/update-recovery.d.ts

@@ -1,7 +1,9 @@
+import { PRIVATE_LAUNCH_CONTRACT } from "../launch-context/index.js";
 import type { UpdateTransaction, UpdateRecoveryState } from "./update-transaction.js";
 export declare const UPDATE_RECOVERY_SCHEMA: "a1-update-recovery-v1";
 export interface UpdateRecoveryCapsule {
     readonly schema: typeof UPDATE_RECOVERY_SCHEMA;
+    readonly launchContract: typeof PRIVATE_LAUNCH_CONTRACT;
     readonly transactionId: string;
     readonly packageName: string;
     readonly targetVersion: string;

package/dist/foundation/release/update-recovery.js

@@ -5,6 +5,7 @@ import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
 import { processIsAlive } from "./process-cleanup.js";
+import { PRIVATE_LAUNCH_CONTRACT, assertCurrentLaunchContract } from "../launch-context/index.js";
 export const UPDATE_RECOVERY_SCHEMA = "a1-update-recovery-v1";
 const WORKER_TIMEOUT_MS = 15 * 60 * 1_000;
 const POLL_MS = 50;
@@ -18,6 +19,7 @@ export function updateLauncherPaths(globalRoot, platform = process.platform) {
 /** Validate transaction-scoped recovery authority without trusting npm temporary names. */
 export async function readUpdateRecoveryCapsule(manifestPath, platform = process.platform) {
     const capsule = JSON.parse(await readFile(manifestPath, "utf8"));
+    assertCurrentLaunchContract(capsule);
     if (capsule.schema !== UPDATE_RECOVERY_SCHEMA || !/^[0-9a-f-]{36}$/i.test(capsule.transactionId) || typeof capsule.targetVersion !== "string"
         || capsule.packageName !== PRODUCT_TEXT.packageName || typeof capsule.packageRoot !== "string" || typeof capsule.globalRoot !== "string"
         || typeof capsule.launcherRoot !== "string" || !Array.isArray(capsule.launchers) || typeof capsule.priorReleaseId !== "string"
@@ -59,6 +61,7 @@ export async function readUpdateRecoveryCapsule(manifestPath, platform = process
     if (priorReleaseRoot.split(sep).at(-1) !== capsule.priorReleaseId)
         throw new Error("recovery prior release identity is invalid");
     const priorManifest = JSON.parse(await readFile(resolve(priorReleaseRoot, capsule.releaseManifestName), "utf8"));
+    assertCurrentLaunchContract(priorManifest);
     if (priorManifest.releaseId !== capsule.priorReleaseId || priorManifest.contentDigest !== capsule.priorContentDigest) {
         throw new Error("recovery prior release manifest differs from the capsule");
     }
@@ -95,6 +98,7 @@ export async function prepareUpdateRecoveryCapsule(options) {
         const npmCli = await resolveNpmCli(canonicalGlobal, options.environment ?? process.env);
         const capsule = {
             schema: UPDATE_RECOVERY_SCHEMA,
+            launchContract: PRIVATE_LAUNCH_CONTRACT,
             transactionId: options.transaction.transactionId,
             packageName: PRODUCT_TEXT.packageName,
             targetVersion: options.transaction.targetVersion,

package/dist/foundation/release/update.js

@@ -448,7 +448,7 @@ export async function runSelfUpdate(options) {
                     transaction = await transactionStore.advance("package-installed");
                 if (replacement.cancelled) {
                     progress.clear();
-                    output.stderr(`${PRODUCT_TEXT.diagnostic("update cancelled safely; the A1 launcher is available and the transaction can be resumed.")}\n`);
+                    output.stderr(`${PRODUCT_TEXT.diagnostic("update cancelled safely; the launcher is available and the transaction can be resumed.")}\n`);
                     return 130;
                 }
                 if (replacement.outcome !== "installed") {

package/dist/foundation/release/warmup.d.ts

@@ -1,3 +1,3 @@
-import type { MaterializedRelease } from "./release-store.js";
+import { type MaterializedRelease } from "./release-store.js";
 /** Import the exact immutable startup graph in a terminal-free bounded child process. */
 export declare function warmMaterializedRelease(release: MaterializedRelease, environment: NodeJS.ProcessEnv, timeoutMs?: number): Promise<void>;

package/dist/foundation/release/warmup.js

@@ -1,16 +1,28 @@
 import { spawn } from "node:child_process";
-import { resolve } from "node:path";
+import { resolveReleaseEntryPoint } from "./release-store.js";
 import { releaseEnvironment } from "./bootstrap.js";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { launchContractTarget, launchEnvironmentKeys } from "../launch-context/index.js";
+const WARMUP_DIAGNOSTIC_LIMIT = 2_000;
+/** Summarize the child's own failure text without letting an unbounded graph error escape. */
+function warmupDiagnostics(text) {
+    const lines = text.split(/\r?\n/).map(line => line.trim()).filter(line => line.length > 0);
+    return lines.length === 0 ? "" : `: ${lines.slice(0, 4).join(" | ").slice(0, WARMUP_DIAGNOSTIC_LIMIT)}`;
+}
 /** Import the exact immutable startup graph in a terminal-free bounded child process. */
 export async function warmMaterializedRelease(release, environment, timeoutMs = 30_000) {
-    const entry = resolve(release.releaseRoot, "bin", "warmup.js");
+    const entry = await resolveReleaseEntryPoint(release, "bin/warmup.js");
     await new Promise((resolvePromise, rejectPromise) => {
+        // Rationale: the child still gets no terminal, but a discarded failure reason leaves an
+        // update reporting only an exit status. Its own diagnostics are read and bounded so the
+        // transaction journal records why the graph could not be imported.
         const child = spawn(process.execPath, [entry], {
-            env: { ...releaseEnvironment(environment, release), [PRODUCT_IDENTITY.environment.immutableWarmup]: "1" },
-            stdio: "ignore",
+            env: { ...releaseEnvironment(environment, release), [launchEnvironmentKeys(launchContractTarget(release)).immutableWarmup]: "1" },
+            stdio: ["ignore", "ignore", "pipe"],
             windowsHide: true,
         });
+        let diagnostics = "";
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", chunk => { diagnostics = `${diagnostics}${chunk}`.slice(-WARMUP_DIAGNOSTIC_LIMIT); });
         let settled = false;
         const finish = (error) => {
             if (settled)
@@ -25,7 +37,7 @@ export async function warmMaterializedRelease(release, environment, timeoutMs =
         child.once("error", error => finish(error));
         child.once("close", (code, signal) => finish(code === 0
             ? undefined
-            : new Error(`immutable startup warmup exited with ${code === null ? signal ?? "unknown status" : `status ${code}`}`)));
+            : new Error(`immutable startup warmup exited with ${code === null ? signal ?? "unknown status" : `status ${code}`}${warmupDiagnostics(diagnostics)}`)));
         const timer = setTimeout(() => {
             child.kill();
             finish(new Error(`immutable startup warmup exceeded ${timeoutMs}ms`));