chainlesschain 0.166.34 → 0.166.36

package/src/lib/evolution/evolution-witness-segments.js

@@ -0,0 +1,330 @@
+import path from "node:path";
+import { ensurePrivateDirectory } from "../secure-fs.js";
+
+export const EVOLUTION_SEGMENTED_WITNESS_SCHEMA =
+  "chainlesschain.evolution-file-witness-store/v2";
+const SEGMENT_SCHEMA = "chainlesschain.evolution-file-witness-segment/v1";
+export const EVOLUTION_WITNESS_SEGMENT_RECORDS = 256;
+const MAX_RECORDS = 262_144;
+const MAX_SEGMENTS = MAX_RECORDS / EVOLUTION_WITNESS_SEGMENT_RECORDS;
+const MAX_CACHE_BYTES = 16 * 1024 * 1024;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const HEAD_KEYS = new Set([
+  "schema",
+  "current",
+  "segments",
+  "history",
+  "discardedAnchors",
+]);
+const SEGMENT_KEYS = new Set(["schema", "history", "discardedAnchors"]);
+
+function exact(value, keys, label) {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.keys(value).length !== keys.size ||
+    Object.keys(value).some((key) => !keys.has(key))
+  ) {
+    throw new Error(`${label} fields are invalid`);
+  }
+}
+
+function matchesDiscard(entry, snapshot) {
+  return (
+    snapshot &&
+    (entry.anchorDigest === snapshot.anchorDigest ||
+      entry.headDigest === snapshot.headDigest ||
+      entry.segmentDigest === snapshot.segmentDigest)
+  );
+}
+
+/** Internal storage adapter. Record signatures and trust policy stay with the witness. */
+export function createEvolutionWitnessSegments({
+  filePath,
+  fsImpl,
+  readBytes,
+  writeBytes,
+  confirmDurable,
+  validateStore,
+  legacySchema,
+  canonical,
+  hash,
+  encodeRecord,
+  maximumHistoryBytes,
+}) {
+  const segmentDirectory = `${filePath}.segments-v2`;
+  const secureOptions = { deps: { fs: fsImpl }, failIfUnavailable: true };
+  const metadata = new WeakMap();
+  const cache = new Map();
+  let cacheBytes = 0;
+
+  const segmentPath = (digest) => {
+    if (!DIGEST.test(digest || ""))
+      throw new Error("witness segment digest is invalid");
+    return path.join(segmentDirectory, `${digest.slice(7)}.json`);
+  };
+
+  const assertDirectory = () => {
+    ensurePrivateDirectory(segmentDirectory, secureOptions);
+    const observed = fsImpl.lstatSync(segmentDirectory);
+    if (!observed.isDirectory() || observed.isSymbolicLink()) {
+      throw new Error("witness segment directory is invalid");
+    }
+  };
+
+  const validateSegment = (segment, previous, trustEpoch) => {
+    exact(segment, SEGMENT_KEYS, "witness segment");
+    if (
+      segment.schema !== SEGMENT_SCHEMA ||
+      !Array.isArray(segment.history) ||
+      segment.history.length !== EVOLUTION_WITNESS_SEGMENT_RECORDS
+    ) {
+      throw new Error("witness segment length or schema is invalid");
+    }
+    validateStore(
+      {
+        schema: legacySchema,
+        current: segment.history.at(-1),
+        history: segment.history,
+        discardedAnchors: segment.discardedAnchors,
+      },
+      trustEpoch,
+      previous,
+    );
+    return segment;
+  };
+
+  const observe = (records, discardedAnchors, observations) => {
+    for (const query of observations.discards) {
+      if (
+        discardedAnchors.some((entry) => matchesDiscard(entry, query.snapshot))
+      ) {
+        query.matched = true;
+      }
+    }
+    for (const query of observations.records) {
+      const firstGeneration = records[0].generation;
+      const index = query.checkpoint.generation - firstGeneration;
+      if (Number.isSafeInteger(index) && index >= 0 && index < records.length) {
+        const record = records[index];
+        if (record.witnessDigest === query.checkpoint.witnessDigest)
+          query.record = record;
+      }
+    }
+  };
+
+  const remember = (digest, segment, trustEpoch) => {
+    if (trustEpoch === null) return;
+    // A cached decision belongs only to bytes rehashed on this read and a
+    // current verifier epoch. Copy through a small encoding so no parser
+    // substring can retain a whole source segment.
+    const encoded = canonical({
+      first: segment.history[0],
+      last: segment.history.at(-1),
+      discardedAnchors: segment.discardedAnchors,
+    });
+    const bytes = 6 * encoded.length;
+    const existing = cache.get(digest);
+    if (existing) cacheBytes -= existing.bytes;
+    cache.delete(digest);
+    if (cache.size >= MAX_SEGMENTS || cacheBytes + bytes > MAX_CACHE_BYTES)
+      return;
+    cache.set(digest, { ...JSON.parse(encoded), trustEpoch, bytes });
+    cacheBytes += bytes;
+  };
+
+  const load = (head, trustEpoch, options = {}) => {
+    exact(head, HEAD_KEYS, "segmented witness store");
+    if (
+      head.schema !== EVOLUTION_SEGMENTED_WITNESS_SCHEMA ||
+      !Array.isArray(head.segments) ||
+      head.segments.length < 1 ||
+      head.segments.length >= MAX_SEGMENTS ||
+      !Array.isArray(head.history) ||
+      head.history.length < 1 ||
+      head.history.length > EVOLUTION_WITNESS_SEGMENT_RECORDS ||
+      head.segments.length * EVOLUTION_WITNESS_SEGMENT_RECORDS +
+        head.history.length >
+        MAX_RECORDS
+    ) {
+      throw new Error("segmented witness store capacity or schema is invalid");
+    }
+    assertDirectory();
+    const seen = new Set();
+    const observations = {
+      discards: (options.discards || [])
+        .filter(Boolean)
+        .map((snapshot) => ({ snapshot, matched: false })),
+      records: (options.records || []).map((checkpoint) => ({
+        checkpoint,
+        record: null,
+      })),
+    };
+    let previous = null;
+    let storedBytes = options.headBytes;
+    if (
+      !Number.isSafeInteger(storedBytes) ||
+      storedBytes < 1 ||
+      storedBytes > maximumHistoryBytes
+    ) {
+      throw new Error("witness history exceeds its configured maximum size");
+    }
+    for (const digest of head.segments) {
+      if (seen.has(digest)) throw new Error("witness segment is repeated");
+      seen.add(digest);
+      const bytes = readBytes(
+        segmentPath(digest),
+        maximumHistoryBytes - storedBytes,
+      );
+      storedBytes += bytes.length;
+      if (hash(bytes) !== digest)
+        throw new Error("witness segment bytes changed");
+      const cached = cache.get(digest);
+      const canReuse =
+        cached && trustEpoch !== null && cached.trustEpoch === trustEpoch;
+      const needsRecord = observations.records.some(
+        ({ checkpoint }) =>
+          canReuse &&
+          checkpoint.generation >= cached.first.generation &&
+          checkpoint.generation <= cached.last.generation,
+      );
+      if (canReuse) {
+        if (
+          (!previous && cached.first.generation !== 0) ||
+          (previous &&
+            (cached.first.generation !== previous.generation + 1 ||
+              cached.first.previousWitnessDigest !== previous.witnessDigest))
+        ) {
+          throw new Error("witness segment history is not contiguous");
+        }
+        for (const query of observations.discards) {
+          if (
+            cached.discardedAnchors.some((entry) =>
+              matchesDiscard(entry, query.snapshot),
+            )
+          ) {
+            query.matched = true;
+          }
+        }
+        if (needsRecord) {
+          const parsed = JSON.parse(
+            new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+          );
+          observe(parsed.history, parsed.discardedAnchors, observations);
+        }
+        previous = cached.last;
+        continue;
+      }
+      const parsed = JSON.parse(
+        new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+      );
+      const segment = validateSegment(parsed, previous, trustEpoch);
+      observe(segment.history, segment.discardedAnchors, observations);
+      remember(digest, segment, trustEpoch);
+      previous = segment.history.at(-1);
+    }
+    const store = validateStore(
+      {
+        schema: legacySchema,
+        current: head.current,
+        history: head.history,
+        discardedAnchors: head.discardedAnchors,
+      },
+      trustEpoch,
+      previous,
+    );
+    observe(store.history, store.discardedAnchors, observations);
+    metadata.set(store, {
+      segments: [...head.segments],
+      observations,
+      tailPreviousDiscardDigest: previous.discardAccumulatorDigest,
+      segmentBytes: storedBytes - options.headBytes,
+    });
+    return store;
+  };
+
+  const publish = (store) => {
+    const existing = metadata.get(store);
+    const segments = [...(existing?.segments || [])];
+    if (
+      segments.length * EVOLUTION_WITNESS_SEGMENT_RECORDS +
+        store.history.length >
+      MAX_RECORDS
+    ) {
+      throw new Error("witness history exceeds its configured record capacity");
+    }
+    assertDirectory();
+    let history = store.history;
+    let discardedAnchors = store.discardedAnchors;
+    let segmentBytes = existing?.segmentBytes ?? 0;
+    let accumulator =
+      existing?.tailPreviousDiscardDigest ??
+      history[0].discardAccumulatorDigest;
+    while (history.length > EVOLUTION_WITNESS_SEGMENT_RECORDS) {
+      const records = history.slice(0, EVOLUTION_WITNESS_SEGMENT_RECORDS);
+      let discardCount = 0;
+      // The first record's predecessor may belong to the preceding segment.
+      // The caller carries the exact predecessor accumulator when loading.
+      for (const record of records) {
+        if (record.discardAccumulatorDigest !== accumulator) discardCount++;
+        accumulator = record.discardAccumulatorDigest;
+      }
+      const part = {
+        schema: SEGMENT_SCHEMA,
+        history: records,
+        discardedAnchors: discardedAnchors.slice(0, discardCount),
+      };
+      const bytes = Buffer.from(`${canonical(part)}\n`, "utf8");
+      segmentBytes += bytes.length;
+      if (segmentBytes > maximumHistoryBytes) {
+        throw new Error("witness history exceeds its configured maximum size");
+      }
+      const digest = hash(bytes);
+      const destination = segmentPath(digest);
+      if (fsImpl.existsSync(destination)) {
+        if (!readBytes(destination).equals(bytes)) {
+          throw new Error(
+            "existing witness segment differs from its content address",
+          );
+        }
+        // A previous process may have stopped after rename and before fsync of
+        // the directory. Reuse requires that durability boundary again.
+        confirmDurable(destination, bytes);
+      } else {
+        // The witness CAS lock serializes publication. Only complete, fsynced
+        // bytes are renamed into this immutable content address before HEAD.
+        writeBytes(destination, bytes);
+      }
+      segments.push(digest);
+      history = history.slice(EVOLUTION_WITNESS_SEGMENT_RECORDS);
+      discardedAnchors = discardedAnchors.slice(discardCount);
+    }
+    const encoded = `{"current":${encodeRecord(store.current)},"discardedAnchors":${canonical(discardedAnchors)},"history":[${history.map(encodeRecord).join(",")}],"schema":${JSON.stringify(EVOLUTION_SEGMENTED_WITNESS_SCHEMA)},"segments":${canonical(segments)}}`;
+    const headBytes = Buffer.from(`${encoded}\n`, "utf8");
+    if (segmentBytes + headBytes.length > maximumHistoryBytes) {
+      throw new Error("witness history exceeds its configured maximum size");
+    }
+    writeBytes(filePath, headBytes);
+    return store.current;
+  };
+
+  return {
+    load,
+    publish,
+    handles: (store) =>
+      metadata.has(store) ||
+      store.history.length > EVOLUTION_WITNESS_SEGMENT_RECORDS,
+    isSegmented: (store) => metadata.has(store),
+    isDiscarded: (store, snapshot) =>
+      metadata
+        .get(store)
+        ?.observations.discards.find((query) => query.snapshot === snapshot)
+        ?.matched === true,
+    lookup: (store, checkpoint) =>
+      metadata
+        .get(store)
+        ?.observations.records.find((query) => query.checkpoint === checkpoint)
+        ?.record ?? null,
+  };
+}

package/src/lib/evolution/progressive-canary-external-watchdog.js

@@ -218,6 +218,7 @@ export function createProgressiveCanaryHeartbeatAuthority({
   const authority = Object.freeze({
     planDigest: plan.planDigest,
     async issue({ sequence, stage, activeStateDigest } = {}) {
+      const issuedAt = timestamp(Number(now()), "heartbeat clock");
       const payload = {
         schema: PROGRESSIVE_CANARY_HOST_HEARTBEAT_SCHEMA,
         planDigest: plan.planDigest,
@@ -228,15 +229,16 @@ export function createProgressiveCanaryHeartbeatAuthority({
         sequence: timestamp(sequence, "heartbeat sequence"),
         stage: id(stage, "heartbeat stage"),
         activeStateDigest: digest(activeStateDigest, "activeStateDigest"),
-        issuedAt: timestamp(Number(now()), "heartbeat clock"),
-        expiresAt: Number(now()) + plan.leaseDurationMs,
+        issuedAt,
+        expiresAt: timestamp(
+          issuedAt + plan.leaseDurationMs,
+          "heartbeat expiry",
+        ),
         authorityId: plan.heartbeatAuthority.id,
         authorityRevision: plan.heartbeatAuthority.revision,
         handlerDigest: plan.heartbeatAuthority.handlerDigest,
         publicKeySpkiDigest: plan.heartbeatAuthority.publicKeySpkiDigest,
       };
-      if (payload.expiresAt !== payload.issuedAt + plan.leaseDurationMs)
-        throw new Error("heartbeat clock changed during issuance");
       const signature = await attestor(Object.freeze(structuredClone(payload)));
       const core = { ...payload, signature };
       return verify(

package/src/lib/evolution/skill-candidate-registry.js

@@ -4,6 +4,7 @@ import path from "node:path";
 import { types as utilTypes } from "node:util";
 import { getHomeDir } from "../paths.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
+import { withEvolutionFileIdentity } from "./evolution-file-identity.js";
 import {
   verifySkillDependencyLock,
   verifySkillRuntimeManifest,
@@ -1793,6 +1794,15 @@ export class SkillCandidateRegistry {
   }
 
   _initializeTenantMarker() {
+    return withEvolutionFileIdentity(
+      this._fs,
+      this._markerPath,
+      (_full, sameStable) =>
+        this.#initializeTenantMarkerWithIdentity(sameStable),
+    );
+  }
+
+  #initializeTenantMarkerWithIdentity(sameStable) {
     const existing = lstatOrNull(this._fs, this._markerPath);
     if (existing) {
       const verified = this._readAndVerifyTenantMarker();
@@ -1832,7 +1842,6 @@ export class SkillCandidateRegistry {
           "candidate tenant marker temporary file is unsafe",
         );
       }
-      const writtenIdentity = entryIdentity(written);
       this._fs.closeSync(descriptor);
       descriptor = null;
       if (this._secure) {
@@ -1847,7 +1856,7 @@ export class SkillCandidateRegistry {
         staged.isSymbolicLink() ||
         Number(staged.nlink) !== 1 ||
         staged.size !== bytes.length ||
-        entryIdentity(staged) !== writtenIdentity ||
+        !sameStable(staged, written) ||
         !samePath(realpath(this._fs, temporaryPath), temporaryPath)
       ) {
         throw registryError(
@@ -1870,7 +1879,7 @@ export class SkillCandidateRegistry {
         !linked.isFile() ||
         linked.isSymbolicLink() ||
         Number(linked.nlink) !== 2 ||
-        entryIdentity(linked) !== writtenIdentity
+        entryIdentity(linked) !== entryIdentity(staged)
       ) {
         throw registryError(
           "SKILL_CANDIDATE_STORE_UNSAFE",
@@ -1901,6 +1910,24 @@ export class SkillCandidateRegistry {
   }
 
   _readBoundedRegularFile(filePath, maximum, code, label) {
+    return withEvolutionFileIdentity(this._fs, filePath, (samePathHandle) =>
+      this.#readBoundedRegularFileWithIdentity(
+        filePath,
+        maximum,
+        code,
+        label,
+        samePathHandle,
+      ),
+    );
+  }
+
+  #readBoundedRegularFileWithIdentity(
+    filePath,
+    maximum,
+    code,
+    label,
+    samePathHandle,
+  ) {
     let descriptor = null;
     try {
       const before = this._fs.lstatSync(filePath);
@@ -1925,7 +1952,7 @@ export class SkillCandidateRegistry {
       if (
         !opened.isFile() ||
         Number(opened.nlink) !== 1 ||
-        entryIdentity(opened) !== entryIdentity(before) ||
+        !samePathHandle(before, opened) ||
         opened.size !== before.size
       ) {
         throw registryError(code, `${label} changed while it was opened`);
@@ -1941,12 +1968,12 @@ export class SkillCandidateRegistry {
         !afterPath.isFile() ||
         afterPath.isSymbolicLink() ||
         Number(afterPath.nlink) !== 1 ||
-        entryIdentity(afterPath) !== entryIdentity(opened) ||
+        !samePathHandle(afterPath, after) ||
         !samePath(realpath(this._fs, filePath), filePath)
       ) {
         throw registryError(code, `${label} changed while it was read`);
       }
-      return { bytes, identity: entryIdentity(opened) };
+      return { bytes, identity: entryIdentity(before) };
     } finally {
       if (descriptor !== null) this._fs.closeSync(descriptor);
     }
@@ -2637,6 +2664,14 @@ export class SkillCandidateRegistry {
         "candidate create accepts only input; admission context is registry-owned",
       );
     }
+    return withEvolutionFileIdentity(
+      this._fs,
+      this._markerPath,
+      (_full, sameStable) => this.#createWithIdentity(input, sameStable),
+    );
+  }
+
+  #createWithIdentity(input, sameStable) {
     this._assertNoMixedTenantArtifacts();
     const verificationContext = this._resolveAdmissionContext(input);
     const candidate = buildSkillCandidateDraft(input, verificationContext);
@@ -2684,7 +2719,6 @@ export class SkillCandidateRegistry {
           { candidateId: candidate.candidateId, commitState: "not-committed" },
         );
       }
-      const writtenIdentity = entryIdentity(written);
       this._fs.closeSync(descriptor);
       descriptor = null;
       if (this._secure) {
@@ -2699,7 +2733,7 @@ export class SkillCandidateRegistry {
         staged.isSymbolicLink() ||
         Number(staged.nlink) !== 1 ||
         staged.size !== bytes.length ||
-        entryIdentity(staged) !== writtenIdentity ||
+        !sameStable(staged, written) ||
         !samePath(realpath(this._fs, temporaryPath), temporaryPath)
       ) {
         throw registryError(
@@ -2742,7 +2776,7 @@ export class SkillCandidateRegistry {
         linked.isSymbolicLink() ||
         Number(linked.nlink) !== 2 ||
         linked.size !== bytes.length ||
-        entryIdentity(linked) !== writtenIdentity ||
+        entryIdentity(linked) !== entryIdentity(staged) ||
         !samePath(realpath(this._fs, filePath), filePath)
       ) {
         throw registryError(
@@ -2759,7 +2793,7 @@ export class SkillCandidateRegistry {
         finalized.isSymbolicLink() ||
         Number(finalized.nlink) !== 1 ||
         finalized.size !== bytes.length ||
-        entryIdentity(finalized) !== writtenIdentity
+        entryIdentity(finalized) !== entryIdentity(staged)
       ) {
         throw registryError(
           "SKILL_CANDIDATE_COMMIT_UNKNOWN",
@@ -2794,7 +2828,7 @@ export class SkillCandidateRegistry {
         );
       }
       if (
-        stored.identity !== writtenIdentity ||
+        stored.identity !== entryIdentity(staged) ||
         verified.tenantId !== this.tenantId ||
         verified.candidateId !== candidate.candidateId ||
         !stored.bytes.equals(bytes) ||

package/src/lib/evolution/skill-release-registry.js

@@ -5,6 +5,7 @@ import path from "node:path";
 import { types as utilTypes } from "node:util";
 import { getHomeDir } from "../paths.js";
 import { ensurePrivateDirectory, ensurePrivateFile } from "../secure-fs.js";
+import { withEvolutionFileIdentity } from "./evolution-file-identity.js";
 import {
   SKILL_CANDIDATE_MIGRATION_RECEIPT_SCHEMA,
   SKILL_CANDIDATE_MIGRATION_RECORD_SCHEMA,
@@ -2543,6 +2544,26 @@ function lstatOrNull(fsImpl, target) {
 }
 
 function readBoundedSingleLinkFile(fsImpl, filePath, maximum, code, label) {
+  return withEvolutionFileIdentity(fsImpl, filePath, (samePathHandle) =>
+    readBoundedSingleLinkFileWithIdentity(
+      fsImpl,
+      filePath,
+      maximum,
+      code,
+      label,
+      samePathHandle,
+    ),
+  );
+}
+
+function readBoundedSingleLinkFileWithIdentity(
+  fsImpl,
+  filePath,
+  maximum,
+  code,
+  label,
+  samePathHandle,
+) {
   let descriptor = null;
   try {
     const before = fsImpl.lstatSync(filePath);
@@ -2564,7 +2585,7 @@ function readBoundedSingleLinkFile(fsImpl, filePath, maximum, code, label) {
     if (
       !opened.isFile() ||
       Number(opened.nlink) !== 1 ||
-      identity(opened) !== identity(before) ||
+      !samePathHandle(before, opened) ||
       opened.size !== before.size
     ) {
       throw failure(code, `${label} changed while opening`);
@@ -2580,12 +2601,12 @@ function readBoundedSingleLinkFile(fsImpl, filePath, maximum, code, label) {
       !afterPath.isFile() ||
       afterPath.isSymbolicLink() ||
       Number(afterPath.nlink) !== 1 ||
-      identity(afterPath) !== identity(opened) ||
+      !samePathHandle(afterPath, after) ||
       !samePath(realpath(fsImpl, filePath), filePath)
     ) {
       throw failure(code, `${label} changed while reading`);
     }
-    return { bytes, identity: identity(opened) };
+    return { bytes, identity: identity(before) };
   } finally {
     if (descriptor !== null) fsImpl.closeSync(descriptor);
   }
@@ -2786,8 +2807,7 @@ export class SkillReleaseRegistry {
         readActive: SkillReleaseRegistry.prototype.readActive.bind(this),
         readState: SkillReleaseRegistry.prototype.readState.bind(this),
         readRelease: SkillReleaseRegistry.prototype.readRelease.bind(this),
-        readInventory:
-          SkillReleaseRegistry.prototype.readInventory.bind(this),
+        readInventory: SkillReleaseRegistry.prototype.readInventory.bind(this),
         matchesTransactionLedger: (value) => value === transactionLedger,
       }),
     );
@@ -2870,6 +2890,15 @@ export class SkillReleaseRegistry {
   }
 
   #initializeTenantMarker() {
+    return withEvolutionFileIdentity(
+      this.#fs,
+      this.#markerPath,
+      (_full, sameStable) =>
+        this.#initializeTenantMarkerWithIdentity(sameStable),
+    );
+  }
+
+  #initializeTenantMarkerWithIdentity(sameStable) {
     const existing = lstatOrNull(this.#fs, this.#markerPath);
     if (existing) {
       const verified = this.#readAndVerifyTenantMarker();
@@ -2905,7 +2934,6 @@ export class SkillReleaseRegistry {
           "release tenant marker temporary file is unsafe",
         );
       }
-      const writtenIdentity = identity(written);
       this.#fs.closeSync(descriptor);
       descriptor = null;
       if (this.#secure) {
@@ -2920,7 +2948,7 @@ export class SkillReleaseRegistry {
         staged.isSymbolicLink() ||
         Number(staged.nlink) !== 1 ||
         staged.size !== bytes.length ||
-        identity(staged) !== writtenIdentity ||
+        !sameStable(staged, written) ||
         !samePath(realpath(this.#fs, temporaryPath), temporaryPath)
       ) {
         throw failure(
@@ -2943,7 +2971,7 @@ export class SkillReleaseRegistry {
         !linked.isFile() ||
         linked.isSymbolicLink() ||
         Number(linked.nlink) !== 2 ||
-        identity(linked) !== writtenIdentity
+        identity(linked) !== identity(staged)
       ) {
         throw failure(
           "SKILL_RELEASE_STORE_UNSAFE",
@@ -3229,6 +3257,12 @@ export class SkillReleaseRegistry {
       throw failure("SKILL_RELEASE_STORE_UNSAFE", "temporary name is invalid");
     }
     const filePath = this.#path("staging", fileName);
+    return withEvolutionFileIdentity(this.#fs, filePath, (_full, sameStable) =>
+      this.#writeTemporaryWithIdentity(filePath, value, sameStable),
+    );
+  }
+
+  #writeTemporaryWithIdentity(filePath, value, sameStable) {
     const bytes = serialize(value);
     let descriptor = null;
     let writtenIdentity = null;
@@ -3248,7 +3282,7 @@ export class SkillReleaseRegistry {
           "temporary write was incomplete",
         );
       }
-      writtenIdentity = identity(written);
+      writtenIdentity = written;
     } finally {
       if (descriptor !== null) this.#fs.closeSync(descriptor);
     }
@@ -3263,7 +3297,7 @@ export class SkillReleaseRegistry {
       !staged.isFile() ||
       staged.isSymbolicLink() ||
       Number(staged.nlink) !== 1 ||
-      identity(staged) !== writtenIdentity ||
+      !sameStable(staged, writtenIdentity) ||
       staged.size !== bytes.length ||
       !samePath(realpath(this.#fs, filePath), filePath)
     ) {
@@ -4006,8 +4040,8 @@ export class SkillReleaseRegistry {
     }
     const afterReleases = this.#readInventoryNames("artifacts", releasePattern);
     const afterStates = this.#readInventoryNames("active", statePattern);
-    const afterStateDigests = afterStates.map((name) =>
-      this.readState(name.slice(0, -".json".length)).stateDigest,
+    const afterStateDigests = afterStates.map(
+      (name) => this.readState(name.slice(0, -".json".length)).stateDigest,
     );
     if (
       canonicalJson(beforeReleases) !== canonicalJson(afterReleases) ||