@timurproko/a1 0.1.8-dev.322 → 0.1.8-dev.335

package/dist/foundation/release/dependency-certification.d.ts

@@ -0,0 +1,24 @@
+export declare const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
+type LayerIdentity = {
+    readonly layerId: string;
+    readonly contentDigest: string;
+};
+export interface ReadDependencyCertificationOptions {
+    /** Only authenticated parent-started supervisors may upgrade missing platform evidence. */
+    readonly allowLegacyParentCertification?: boolean;
+    /** Cleanup must validate canonical evidence without migrating or falling back. */
+    readonly canonicalOnly?: boolean;
+}
+/** Derive the canonical record path without accepting path components as layer identities. */
+export declare function dependencyLayerCertificationPath(dataDir: string, layerId: string): string;
+/** Keep the historical filename solely for compatibility reads and managed cleanup. */
+export declare function legacyDependencyLayerCertificationPath(dataDir: string, layerId: string): string;
+/** Validate the dedicated directory before reading, creating, or deleting any contained record. */
+export declare function dependencyCertificationDirectory(dataDir: string, create?: boolean): Promise<string | null>;
+/** Resolve only direct regular managed records; callers never follow directory or record links. */
+export declare function managedDependencyCertificationPath(dataDir: string, layerId: string, legacy?: boolean): Promise<string | null>;
+/** Prefer canonical evidence; copy validated legacy evidence without changing its sealed source. */
+export declare function readDependencyCertification(dataDir: string, identity: LayerIdentity, options?: ReadDependencyCertificationOptions): Promise<void>;
+/** Publish certification after materialization/full verification, preserving an already-valid winner. */
+export declare function writeDependencyCertification(dataDir: string, identity: LayerIdentity): Promise<void>;
+export {};

package/dist/foundation/release/dependency-certification.js

@@ -0,0 +1,208 @@
+import { randomUUID } from "node:crypto";
+import { chmod, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+import { PRODUCT_IDENTITY } from "../../product-identity.js";
+import { immutablePlatformPolicy } from "./immutable-platform.js";
+export const DEPENDENCY_CERTIFICATIONS_DIRECTORY = "dependency-certifications";
+/** Derive the canonical record path without accepting path components as layer identities. */
+export function dependencyLayerCertificationPath(dataDir, layerId) {
+    assertLayerId(layerId);
+    return resolve(dataDir, DEPENDENCY_CERTIFICATIONS_DIRECTORY, `${layerId}.json`);
+}
+/** Keep the historical filename solely for compatibility reads and managed cleanup. */
+export function legacyDependencyLayerCertificationPath(dataDir, layerId) {
+    assertLayerId(layerId);
+    return resolve(dataDir, `dependency-layer-certification-${layerId}.json`);
+}
+/** Validate the dedicated directory before reading, creating, or deleting any contained record. */
+export async function dependencyCertificationDirectory(dataDir, create = false) {
+    const canonicalData = await realpath(dataDir);
+    const directory = resolve(canonicalData, DEPENDENCY_CERTIFICATIONS_DIRECTORY);
+    if (create)
+        await mkdir(directory, { mode: 0o700 }).catch(error => {
+            if (!hasCode(error, "EEXIST"))
+                throw error;
+        });
+    const metadata = await lstat(directory).catch(missingOrThrow);
+    if (metadata === null)
+        return null;
+    if (!metadata.isDirectory() || metadata.isSymbolicLink() || await realpath(directory) !== directory) {
+        throw new Error("dependency certification directory is not a managed non-link directory");
+    }
+    return directory;
+}
+/** Resolve only direct regular managed records; callers never follow directory or record links. */
+export async function managedDependencyCertificationPath(dataDir, layerId, legacy = false) {
+    const canonicalData = await realpath(dataDir);
+    const path = legacy ? legacyDependencyLayerCertificationPath(canonicalData, layerId) : dependencyLayerCertificationPath(canonicalData, layerId);
+    if (!legacy && await dependencyCertificationDirectory(canonicalData) === null)
+        return null;
+    const metadata = await lstat(path).catch(missingOrThrow);
+    if (metadata === null)
+        return null;
+    if (!metadata.isFile() || metadata.isSymbolicLink() || await realpath(path) !== path) {
+        throw new Error(`dependency certification is not a managed regular file: ${path}`);
+    }
+    return path;
+}
+/** Prefer canonical evidence; copy validated legacy evidence without changing its sealed source. */
+export async function readDependencyCertification(dataDir, identity, options = {}) {
+    const canonical = await managedDependencyCertificationPath(dataDir, identity.layerId);
+    const source = canonical ?? (options.canonicalOnly ? null : await managedDependencyCertificationPath(dataDir, identity.layerId, true));
+    if (source === null)
+        throw new Error(`dependency layer certification is absent: ${identity.layerId}`);
+    const document = JSON.parse(await readFile(source, "utf8"));
+    const legacyPlatform = validateCertification(document, identity, options.allowLegacyParentCertification === true);
+    if (!legacyPlatform && ((await lstat(source)).mode & 0o222) !== 0)
+        throw new Error("dependency certification is writable");
+    if (legacyPlatform) {
+        // Compatibility: only the authenticated parent path may replace older platform-less evidence.
+        await writeDependencyCertification(dataDir, identity);
+    }
+    else if (canonical === null) {
+        await publishCertification(dataDir, identity, document, false);
+    }
+}
+/** Publish certification after materialization/full verification, preserving an already-valid winner. */
+export async function writeDependencyCertification(dataDir, identity) {
+    await publishCertification(dataDir, identity, {
+        schema: PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema,
+        layerId: identity.layerId,
+        contentDigest: identity.contentDigest,
+        platform: process.platform,
+        platformPolicy: immutablePlatformPolicy(),
+        certifiedAt: new Date().toISOString(),
+    }, true);
+}
+async function publishCertification(dataDir, identity, document, replaceInvalid) {
+    const directory = (await dependencyCertificationDirectory(dataDir, true));
+    const path = dependencyLayerCertificationPath(dirname(directory), identity.layerId);
+    const lockPath = `${path}.lock`;
+    const releaseLock = await acquirePublicationLock(lockPath);
+    try {
+        await publishLockedCertification(dataDir, identity, document, replaceInvalid, path);
+    }
+    finally {
+        await releaseLock();
+    }
+}
+async function publishLockedCertification(dataDir, identity, document, replaceInvalid, path) {
+    const existing = await managedDependencyCertificationPath(dataDir, identity.layerId);
+    if (existing !== null) {
+        const source = await readFile(existing, "utf8");
+        const metadata = await lstat(existing);
+        try {
+            validateCertification(JSON.parse(source), identity);
+            // Invariant: full verification restores writable evidence; ordinary valid reuse is read-only.
+            if ((metadata.mode & 0o222) === 0)
+                return;
+            if (!replaceInvalid)
+                throw new Error("dependency certification is writable");
+        }
+        catch (error) {
+            if (!replaceInvalid)
+                throw error;
+        }
+        await rm(existing, { force: true });
+    }
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await writeFile(temporary, JSON.stringify(document, null, 2), { flag: "wx", mode: 0o400 });
+        await chmod(temporary, 0o400);
+        await dependencyCertificationDirectory(dataDir);
+        // Concurrency: the per-layer lease protects the winner check and atomic publication together.
+        // Rename publishes final read-only metadata; no later temporary unlink changes sealed evidence.
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+async function acquirePublicationLock(path) {
+    const token = randomUUID();
+    const candidate = `${path}.candidate-${token}`;
+    await mkdir(candidate, { mode: 0o700 });
+    try {
+        await writeFile(resolve(candidate, "owner.json"), JSON.stringify({ pid: process.pid, token }), { flag: "wx", mode: 0o600 });
+        const deadline = Date.now() + 5_000;
+        while (true) {
+            try {
+                // Concurrency: a nonempty directory cannot replace another nonempty directory on either
+                // platform. Publishing the complete owner atomically also avoids partially written leases.
+                await rename(candidate, path);
+                return async () => {
+                    const released = `${path}.released-${token}`;
+                    await rename(path, released);
+                    await rm(released, { recursive: true, force: true });
+                };
+            }
+            catch (error) {
+                if (!["EEXIST", "ENOTEMPTY", "EPERM", "EACCES"].some(code => hasCode(error, code)))
+                    throw error;
+                const metadata = await lstat(path).catch(missingOrThrow);
+                if (metadata !== null) {
+                    if (!metadata.isDirectory() || metadata.isSymbolicLink())
+                        throw new Error("dependency certification publication lock is not a managed directory");
+                    const ownerPath = resolve(path, "owner.json");
+                    const ownerMetadata = await lstat(ownerPath).catch(missingOrThrow);
+                    if (ownerMetadata !== null) {
+                        if (!ownerMetadata.isFile() || ownerMetadata.isSymbolicLink())
+                            throw new Error("dependency certification publication owner is not a regular file");
+                        const owner = await readFile(ownerPath, "utf8").then(source => JSON.parse(source)).catch(error => {
+                            if (hasCode(error, "ENOENT"))
+                                return null;
+                            throw error;
+                        });
+                        if (owner !== null && Number.isSafeInteger(owner.pid) && owner.pid > 0 && /^[a-f0-9-]{36}$/.test(owner.token)) {
+                            let abandoned = false;
+                            try {
+                                process.kill(owner.pid, 0);
+                            }
+                            catch (probeError) {
+                                abandoned = hasCode(probeError, "ESRCH");
+                            }
+                            if (abandoned) {
+                                // Concurrency: retain this generation's nonempty tombstone. A delayed second reclaimer
+                                // cannot overwrite it and accidentally steal a newly acquired replacement lease.
+                                await rename(path, `${path}.abandoned-${owner.token}`).catch(error => {
+                                    if (!["ENOENT", "EEXIST", "ENOTEMPTY", "EPERM", "EACCES"].some(code => hasCode(error, code)))
+                                        throw error;
+                                });
+                            }
+                        }
+                    }
+                }
+                if (Date.now() >= deadline)
+                    throw new Error("dependency certification publication is busy");
+                await new Promise(resolvePromise => setTimeout(resolvePromise, 20));
+            }
+        }
+    }
+    finally {
+        await rm(candidate, { recursive: true, force: true });
+    }
+}
+function validateCertification(value, identity, allowLegacyPlatform = false) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`dependency layer certification differs from manifest: ${identity.layerId}`);
+    const certification = value;
+    const identityMatches = certification.schema === PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema
+        && certification.layerId === identity.layerId && certification.contentDigest === identity.contentDigest;
+    const currentPlatform = certification.platform === process.platform && certification.platformPolicy === immutablePlatformPolicy();
+    const legacyPlatform = allowLegacyPlatform && certification.platform === undefined && certification.platformPolicy === undefined;
+    if (!identityMatches || (!currentPlatform && !legacyPlatform))
+        throw new Error(`dependency layer certification differs from manifest: ${identity.layerId}`);
+    return legacyPlatform;
+}
+function assertLayerId(layerId) {
+    if (!/^dependencies-[a-f0-9]{32}$/.test(layerId))
+        throw new Error(`invalid dependency layer identity: ${layerId}`);
+}
+function hasCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+function missingOrThrow(error) {
+    if (hasCode(error, "ENOENT"))
+        return null;
+    throw error;
+}

package/dist/foundation/release/dependency-layer.d.ts

@@ -1,3 +1,5 @@
+import { type ReadDependencyCertificationOptions } from "./dependency-certification.js";
+export { dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath } from "./dependency-certification.js";
 import { type ReleaseFileIdentity } from "./release.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 export declare const DEPENDENCY_LAYER_SCHEMA: string;
@@ -37,9 +39,7 @@ export interface DependencyLayerOperationEvent {
     readonly path: string;
     readonly bytes: number;
 }
-export interface ReadCertifiedDependencyLayerOptions {
-    /** Accept and replace certification written by the immediately preceding updater format. */
-    readonly allowLegacyParentCertification?: boolean;
+export interface ReadCertifiedDependencyLayerOptions extends ReadDependencyCertificationOptions {
 }
 export interface SelectedRuntimePayload {
     readonly paths: readonly string[];
@@ -79,4 +79,3 @@ export declare function readCertifiedDependencyLayer(dataDir: string, layerId: s
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */
 export declare function verifyDependencyLayer(dataDir: string, reference: DependencyLayerReference, onOperation?: (event: DependencyLayerOperationEvent) => void): Promise<Omit<MaterializedDependencyLayer, "reused">>;
 export declare function dependencyReference(layer: MaterializedDependencyLayer): DependencyLayerReference;
-export declare function dependencyLayerCertificationPath(dataDir: string, layerId: string): string;

package/dist/foundation/release/dependency-layer.js

@@ -2,7 +2,9 @@ import { randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, readFile, realpath, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, posix, relative, resolve, sep } from "node:path";
 import { mapWithConcurrency } from "./concurrency.js";
-import { assertImmutableFileMode, immutablePlatformPolicy } from "./immutable-platform.js";
+import { assertImmutableFileMode } from "./immutable-platform.js";
+import { readDependencyCertification, writeDependencyCertification as writeLayerCertification } from "./dependency-certification.js";
+export { dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath } from "./dependency-certification.js";
 import { digestManifestFiles, releaseFileIdentity, resolveWithin } from "./release.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
 const LAYER_IO_CONCURRENCY = 32;
@@ -281,20 +283,9 @@ export async function readCertifiedDependencyLayer(dataDir, layerId, expected, o
     if (expected && (expected.layerId !== manifest.layerId || expected.contentDigest !== manifest.contentDigest)) {
         throw new Error(`dependency layer identity mismatch: ${layerId}`);
     }
-    const certification = JSON.parse(await readFile(certificationPath(dataDir, layerId), "utf8"));
-    const identityMatches = certification.schema === PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema
-        && certification.layerId === manifest.layerId && certification.contentDigest === manifest.contentDigest;
-    const currentPlatformEvidence = certification.platform === process.platform && certification.platformPolicy === immutablePlatformPolicy();
-    // Compatibility: the updater that introduced layers certified these exact identities but did
-    // not record platform fields. Only an authenticated parent-started supervisor opts into this
-    // transition; durable/reuse readers remain strict and cannot treat the legacy marker as authority.
-    const legacyParentCertification = options.allowLegacyParentCertification === true
-        && certification.platform === undefined && certification.platformPolicy === undefined;
-    if (!identityMatches || (!currentPlatformEvidence && !legacyParentCertification)) {
-        throw new Error(`dependency layer certification differs from manifest: ${layerId}`);
-    }
-    if (legacyParentCertification)
-        await writeLayerCertification(dataDir, manifest);
+    if (manifest.layerId !== layerId)
+        throw new Error(`dependency layer identity mismatch: ${layerId}`);
+    await readDependencyCertification(dataDir, manifest, options);
     return { ...manifest, layerRoot };
 }
 /** Fully verify a layer when certification is absent or explicit tamper evidence is required. */
@@ -326,12 +317,6 @@ export async function verifyDependencyLayer(dataDir, reference, onOperation) {
 export function dependencyReference(layer) {
     return { layerId: layer.layerId, contentDigest: layer.contentDigest, binding: "node_modules" };
 }
-export function dependencyLayerCertificationPath(dataDir, layerId) {
-    return certificationPath(dataDir, layerId);
-}
-function certificationPath(dataDir, layerId) {
-    return resolve(dataDir, `dependency-layer-certification-${layerId}.json`);
-}
 async function reuseDependencyLayer(dataDir, identity) {
     try {
         return await readCertifiedDependencyLayer(dataDir, identity.layerId, identity);
@@ -343,22 +328,6 @@ async function reuseDependencyLayer(dataDir, identity) {
         return verified;
     }
 }
-async function writeLayerCertification(dataDir, identity) {
-    const path = certificationPath(dataDir, identity.layerId);
-    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-    await writeFile(temporary, JSON.stringify({
-        schema: PRODUCT_IDENTITY.evidence.dependencyLayerCertificationSchema,
-        layerId: identity.layerId,
-        contentDigest: identity.contentDigest,
-        platform: process.platform,
-        platformPolicy: immutablePlatformPolicy(),
-        certifiedAt: new Date().toISOString(),
-    }, null, 2), { flag: "wx", mode: 0o400 });
-    await chmod(path, 0o600).catch(() => { });
-    await rm(path, { force: true });
-    await rename(temporary, path);
-    await chmod(path, 0o400);
-}
 function validateLayerManifest(value) {
     if (value.schema !== DEPENDENCY_LAYER_SCHEMA || !/^dependencies-[a-f0-9]{32}$/.test(value.layerId)
         || !/^[a-f0-9]{64}$/.test(value.contentDigest) || !Array.isArray(value.files) || value.files.length === 0

package/dist/foundation/release/index.d.ts

@@ -10,6 +10,7 @@ export * from "./release-store.js";
 export * from "./restart-certification.js";
 export * from "./stable-release.js";
 export * from "./update.js";
+export * from "./update-launch.js";
 export * from "./update-recovery.js";
 export * from "./update-transaction.js";
 export * from "./warmup.js";

package/dist/foundation/release/index.js

@@ -10,6 +10,7 @@ export * from "./release-store.js";
 export * from "./restart-certification.js";
 export * from "./stable-release.js";
 export * from "./update.js";
+export * from "./update-launch.js";
 export * from "./update-recovery.js";
 export * from "./update-transaction.js";
 export * from "./warmup.js";

package/dist/foundation/release/release-gc.js

@@ -7,7 +7,9 @@ import { CohortStateStore, planProtectedReleases, } from "./cohort-state.js";
 import { liveReleaseIds } from "./endpoints.js";
 import { resolveProductPaths } from "../lifecycle/index.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
-import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath } from "./dependency-layer.js";
+import { DEPENDENCY_LAYER_MANIFEST, readCertifiedDependencyLayer } from "./dependency-layer.js";
+import { dependencyCertificationDirectory, managedDependencyCertificationPath } from "./dependency-certification.js";
+import { dependencyCertificationProtection } from "./dependency-certification-retention.js";
 import { UpdateTransactionStore } from "./update-transaction.js";
 import { cleanupUpdateRecoveryCapsules } from "./update-recovery.js";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
@@ -483,13 +485,19 @@ async function removeAbandonedArtifact(dataDir, path, operations) {
     throw new Error("abandoned artifact is outside managed candidate, trash, or certification paths");
 }
 async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, options) {
+    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
+    if ((await transactionStore.read())?.status === "active")
+        return { attempted: 0, completed: 0 };
+    const protection = await dependencyCertificationProtection(dataDir, Object.keys((await store.read()).releases));
+    if (protection.uncertain)
+        return { attempted: 0, completed: 0 };
+    const { referenced } = protection;
     const layersRoot = resolve(dataDir, "dependency-layers");
     const layersMetadata = await lstat(layersRoot).catch(error => missingOrThrow(error));
     if (layersMetadata === null)
-        return { attempted: 0, completed: 0 };
+        return await collectDependencyCertificationRecords(store, dataDir, protection, maxItems, options);
     if (!layersMetadata.isDirectory() || layersMetadata.isSymbolicLink())
         throw new Error("dependency-layer store is not a managed directory");
-    const referenced = await referencedDependencyLayerIds(dataDir);
     const trashRoot = resolve(layersRoot, ".trash");
     await mkdir(trashRoot, { recursive: true, mode: 0o700 });
     let attempted = 0;
@@ -514,7 +522,12 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
     for (const entry of await readdir(trashRoot, { withFileTypes: true })) {
         candidates.push({ path: resolve(trashRoot, entry.name), layerId: entry.name.split("--", 1)[0] ?? null, inTrash: true });
     }
-    for (const candidate of candidates.slice(0, maxItems)) {
+    const certificates = await collectDependencyCertificationRecords(store, dataDir, protection, Math.min(1, maxItems), options);
+    attempted += certificates.attempted;
+    completed += certificates.completed;
+    for (const candidate of candidates.slice(0, maxItems - attempted)) {
+        if ((await transactionStore.read())?.status === "active")
+            break;
         if (candidate.layerId !== null && referenced.has(candidate.layerId))
             continue;
         attempted += 1;
@@ -541,7 +554,11 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
             }
             await (options.operations?.remove ?? rm)(removalPath, { recursive: true, force: false, maxRetries: 0 });
             if (candidate.layerId !== null && /^dependencies-[a-f0-9]{32}$/.test(candidate.layerId)) {
-                await rm(dependencyLayerCertificationPath(dataDir, candidate.layerId), { force: true });
+                for (const legacy of [false, true]) {
+                    const certificate = await managedDependencyCertificationPath(dataDir, candidate.layerId, legacy);
+                    if (certificate !== null)
+                        await (options.operations?.remove ?? rm)(certificate, { force: true });
+                }
             }
             completed += 1;
         }
@@ -551,22 +568,58 @@ async function collectUnreferencedDependencyLayers(store, dataDir, maxItems, opt
         }
     }
     if (attempted < maxItems) {
-        for (const entry of await readdir(dataDir, { withFileTypes: true })) {
-            const match = /^dependency-layer-certification-(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
-            if (!match || !entry.isFile() || referenced.has(match[1]))
-                continue;
-            if (await lstat(resolve(layersRoot, match[1])).catch(error => missingOrThrow(error)) !== null)
-                continue;
-            attempted += 1;
-            try {
-                await (options.operations?.remove ?? rm)(resolve(dataDir, entry.name), { force: true });
-                completed += 1;
+        const remaining = await collectDependencyCertificationRecords(store, dataDir, protection, maxItems - attempted, options);
+        attempted += remaining.attempted;
+        completed += remaining.completed;
+    }
+    return { attempted, completed };
+}
+async function collectDependencyCertificationRecords(store, dataDir, protection, maxItems, options) {
+    const candidates = new Map();
+    for (const entry of await readdir(dataDir, { withFileTypes: true })) {
+        const match = /^dependency-layer-certification-(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
+        if (match && entry.isFile())
+            candidates.set(resolve(dataDir, entry.name), { layerId: match[1], legacy: true });
+    }
+    try {
+        const directory = await dependencyCertificationDirectory(dataDir);
+        if (directory !== null) {
+            for (const entry of await readdir(directory, { withFileTypes: true })) {
+                const match = /^(dependencies-[a-f0-9]{32})\.json$/.exec(entry.name);
+                if (match && entry.isFile())
+                    candidates.set(resolve(directory, entry.name), { layerId: match[1], legacy: false });
             }
-            catch (error) {
-                await store.recordCleanupFailure(match[1], "dependency-layer-certification", error);
+        }
+    }
+    catch (error) {
+        await store.recordCleanupFailure("dependency-certifications", "certification-discovery", error);
+        return { attempted: 0, completed: 0 };
+    }
+    const transactionStore = options.transactionStore ?? new UpdateTransactionStore(dataDir);
+    let attempted = 0;
+    let completed = 0;
+    for (const candidate of sortArtifacts([...candidates.keys()], await store.read())) {
+        if (attempted >= maxItems || (await transactionStore.read())?.status === "active")
+            break;
+        const { layerId, legacy } = candidates.get(candidate);
+        if (legacy ? protection.legacyRequired.has(layerId) : protection.referenced.has(layerId))
+            continue;
+        const layerExists = await lstat(resolve(dataDir, "dependency-layers", layerId)).catch(missingOrThrow) !== null;
+        if (!legacy && layerExists)
+            continue;
+        try {
+            if (legacy && (layerExists || protection.referenced.has(layerId))) {
+                // Security: a duplicate is disposable only with validated canonical evidence, never fallback.
+                await readCertifiedDependencyLayer(dataDir, layerId, undefined, { canonicalOnly: true });
             }
-            if (attempted >= maxItems)
-                break;
+            attempted += 1;
+            const path = await managedDependencyCertificationPath(dataDir, layerId, legacy);
+            if (path !== null)
+                await (options.operations?.remove ?? rm)(path, { force: true });
+            completed += 1;
+        }
+        catch (error) {
+            await store.recordCleanupFailure(artifactName(candidate), "dependency-layer-certification", error);
         }
     }
     return { attempted, completed };
@@ -585,31 +638,6 @@ async function protectedCompileCachePaths(dataDir, state) {
     }
     return paths;
 }
-async function referencedDependencyLayerIds(dataDir) {
-    const referenced = new Set();
-    const releasesRoot = resolve(dataDir, "releases");
-    const roots = [];
-    for (const entry of await readdir(releasesRoot, { withFileTypes: true }).catch(() => [])) {
-        if (entry.name === ".trash") {
-            for (const trash of await readdir(resolve(releasesRoot, entry.name), { withFileTypes: true }).catch(() => [])) {
-                if (trash.isDirectory())
-                    roots.push(resolve(releasesRoot, entry.name, trash.name));
-            }
-        }
-        else if (entry.isDirectory() && !entry.name.startsWith(".candidate-"))
-            roots.push(resolve(releasesRoot, entry.name));
-    }
-    for (const root of roots) {
-        try {
-            const manifest = JSON.parse(await readFile(resolve(root, RELEASE_MANIFEST_FILENAME), "utf8"));
-            for (const layer of manifest.dependencyLayers ?? [])
-                if (typeof layer.layerId === "string")
-                    referenced.add(layer.layerId);
-        }
-        catch { }
-    }
-    return referenced;
-}
 function assertDirectChild(parent, child) {
     const fromParent = relative(parent, child);
     if (fromParent.length === 0 || fromParent === ".." || fromParent.startsWith(`..${sep}`) || isAbsolute(fromParent) || fromParent.includes(sep)) {

package/dist/foundation/release/release-store.d.ts

@@ -28,6 +28,8 @@ export interface CertifiedReleaseRecord {
     readonly releaseRoot: string;
     readonly packageVersion?: string;
     readonly contentDigest: string;
+    /** Absent on records written before releases declared a handoff contract. */
+    readonly launchContract?: string;
 }
 /** Process-authority compatibility controls for metadata-only release loading. */
 export type ReadCertifiedReleaseManifestOptions = ReadCertifiedDependencyLayerOptions;

package/dist/foundation/release/release-store.js

@@ -3,7 +3,7 @@ import { chmod, lstat, mkdir, readFile, realpath, rename, rm, symlink, writeFile
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_PACKAGE_NAME, createReleaseIdentity, discoverReleasePayload, releaseFileIdentity, resolveWithin, } from "./release.js";
 import { PRODUCT_IDENTITY, PRODUCT_TEXT } from "../../product-identity.js";
-import { assertCurrentLaunchContract, readLaunchContext } from "../launch-context/index.js";
+import { assertCurrentLaunchContract, isCurrentLaunchContract, readLaunchContext } from "../launch-context/index.js";
 import { mapWithConcurrency } from "./concurrency.js";
 import { assertImmutableFileMode } from "./immutable-platform.js";
 import { dependencyReference, materializeDependencyLayer, readCertifiedDependencyLayer, selectPublishedDependencyRuntimePayload, verifyDependencyLayer, } from "./dependency-layer.js";
@@ -156,7 +156,6 @@ export async function assertImmutableExecutionRoot(release, dataDir) {
         throw new Error(PRODUCT_TEXT.diagnostic("persistent process selected a different immutable release root"));
 }
 export async function resolveReleaseEntryPoint(release, entryPoint) {
-    assertCurrentLaunchContract(release);
     const normalized = entryPoint.split("\\").join("/").replace(/^\.\//, "");
     if (!release.files.some(file => file.path === normalized))
         throw new Error(`entry point is not in the verified release manifest: ${entryPoint}`);
@@ -203,7 +202,9 @@ function certificationReadyRelease(release) {
     return release;
 }
 function validateManifest(value) {
-    assertCurrentLaunchContract(value);
+    if (value.launchContract !== undefined && !isCurrentLaunchContract(value)) {
+        throw new Error(PRODUCT_TEXT.diagnostic(`release manifest declares an unsupported launch contract: ${String(value.launchContract)}`));
+    }
     if (value.packageName !== PRODUCT_PACKAGE_NAME || typeof value.packageVersion !== "string")
         throw new Error(PRODUCT_TEXT.diagnostic("release manifest metadata is invalid"));
     if (!/^[a-f0-9]{64}$/.test(value.contentDigest) || !/^[0-9A-Za-z.+_-]+-[a-f0-9]{20}$/.test(value.releaseId))

package/dist/foundation/release/restart-certification.js

@@ -2,8 +2,9 @@ import { createHash } from "node:crypto";
 import { lstat, readFile, realpath, stat } from "node:fs/promises";
 import { basename, isAbsolute, relative, resolve, sep } from "node:path";
 import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { assertCurrentLaunchContract } from "../launch-context/index.js";
-import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath } from "./dependency-layer.js";
+import { PRIVATE_LAUNCH_CONTRACT, launchContractTarget } from "../launch-context/index.js";
+import { DEPENDENCY_LAYER_MANIFEST, dependencyLayerCertificationPath, legacyDependencyLayerCertificationPath, readCertifiedDependencyLayer } from "./dependency-layer.js";
+import { managedDependencyCertificationPath } from "./dependency-certification.js";
 import { immutablePlatformPolicy } from "./immutable-platform.js";
 import { PRODUCT_PACKAGE_NAME } from "./release.js";
 import { RELEASE_MANIFEST_FILENAME } from "./release-store.js";
@@ -12,7 +13,6 @@ const RESTART_SEAL_VERSION = 1;
 const REQUIRED_LAUNCH_ENTRIES = ["bin/supervisor.js", "bin/guardian.js"];
 /** Build compact restart authority after complete content verification established read-only payload files. */
 export async function createRestartSeal(release, dataDir) {
-    assertCurrentLaunchContract(release);
     const policy = immutablePlatformPolicy();
     if (policy === null)
         return null;
@@ -29,6 +29,7 @@ export async function createRestartSeal(release, dataDir) {
     const dependencyLayers = await Promise.all((release.dependencyLayers ?? []).map(async (reference) => {
         if (layersRoot === null)
             throw new Error("restart certification has no dependency-layer root");
+        await readCertifiedDependencyLayer(canonicalData, reference.layerId, reference);
         const layerRoot = await realpath(resolve(layersRoot, reference.layerId));
         assertDirectChild(layersRoot, layerRoot, reference.layerId, "dependency layer");
         const bindingPath = resolve(releaseRoot, reference.binding);
@@ -47,7 +48,7 @@ export async function createRestartSeal(release, dataDir) {
     }));
     const core = {
         version: RESTART_SEAL_VERSION,
-        launchContract: release.launchContract,
+        launchContract: launchContractTarget(release),
         platform: process.platform,
         platformPolicy: policy,
         releaseId: release.releaseId,
@@ -84,7 +85,11 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
         throw new Error("restart certification differs from the approved release record");
     }
     const seal = normalizeRestartSeal(certification.restartSeal);
-    assertCurrentLaunchContract(seal);
+    // Invariant: a seal is restart authority only for a handoff this build can still
+    // perform, which is the contract it emits or the pre-cutover one it retains.
+    if (seal.launchContract !== PRIVATE_LAUNCH_CONTRACT && seal.launchContract !== "superseded") {
+        throw new Error(`restart seal declares an unsupported launch contract: ${String(seal.launchContract)}`);
+    }
     if (seal.platform !== process.platform || seal.platformPolicy !== immutablePlatformPolicy()) {
         throw new Error("restart certification platform immutability evidence is unsupported");
     }
@@ -123,6 +128,12 @@ export async function readRestartCertifiedRelease(record, dataDir, onEvent) {
         assertDirectChild(layersRoot, layerRoot, layer.layerId, "dependency layer");
         await assertPathEvidence(layer.layerRoot, onEvent);
         await assertPathEvidence(layer.manifest, onEvent);
+        const legacyPath = legacyDependencyLayerCertificationPath(canonicalData, layer.layerId);
+        const canonicalPath = dependencyLayerCertificationPath(canonicalData, layer.layerId);
+        if (layer.certification.path !== legacyPath && layer.certification.path !== canonicalPath) {
+            throw new Error("restart dependency certification path is outside managed storage");
+        }
+        await managedDependencyCertificationPath(canonicalData, layer.layerId, layer.certification.path === legacyPath);
         await assertPathEvidence(layer.certification, onEvent);
         await assertPathEvidence(layer.bindingEvidence, onEvent, true);
         const bindingTarget = await observedRealpath(layer.bindingEvidence.path, onEvent);

package/dist/foundation/release/update-launch.d.ts

@@ -0,0 +1,6 @@
+import type { CohortState, ReleaseRecord } from "./cohort-state.js";
+import type { UpdateTransaction } from "./update-transaction.js";
+/** Keep interactive launches on the last successful release until the update commits success. */
+export declare function selectUpdateLaunchRelease(state: CohortState, transaction: UpdateTransaction | null): ReleaseRecord | null;
+/** Pause cohort retirement during preparation; afterward only the successful launch release admits new sessions. */
+export declare function selectSupervisorLaunchReleaseId(state: CohortState, transaction: UpdateTransaction | null): string | null;

package/dist/foundation/release/update-launch.js

@@ -0,0 +1,17 @@
+/** Keep interactive launches on the last successful release until the update commits success. */
+export function selectUpdateLaunchRelease(state, transaction) {
+    if (transaction === null || transaction.status === "completed")
+        return null;
+    const prior = transaction.priorActiveReleaseId === null ? undefined : state.releases[transaction.priorActiveReleaseId];
+    if (!prior || prior.approval !== "approved") {
+        throw new Error("unfinished update has no verified previous release available for launch; resume the update");
+    }
+    return prior;
+}
+/** Pause cohort retirement during preparation; afterward only the successful launch release admits new sessions. */
+export function selectSupervisorLaunchReleaseId(state, transaction) {
+    // Concurrency: both the previous cohort and the warming candidate must remain available until cutover.
+    if (transaction?.status === "active")
+        return null;
+    return selectUpdateLaunchRelease(state, transaction)?.releaseId ?? state.references.active;
+}