chati-dev 4.5.16 → 4.5.28

package/node_modules/@chati/release-lane/src/index.js

@@ -1,7 +1,32 @@
+import { createPublicKey, randomUUID, verify as verifySignature } from 'node:crypto';
+import {
+  closeSync, constants, existsSync, fstatSync, fsyncSync, ftruncateSync, mkdirSync,
+  lstatSync, openSync, readSync, renameSync, unlinkSync, writeSync,
+} from 'node:fs';
+import { hostname } from 'node:os';
+import { basename, dirname, join, parse, resolve, sep } from 'node:path';
 import { ContractError, canonicalize, sha256 } from '@chati/core';
 
 const RFC3339 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+const RELEASE_STATE_MAX_BYTES = 64 * 1024 * 1024;
+const RELEASE_RECORD_MAX_BYTES = 4 * 1024 * 1024;
+const RELEASE_INPUT_MAX_BYTES = 256 * 1024;
+const RELEASE_EXTERNAL_RESERVE_BYTES = 2 * RELEASE_RECORD_MAX_BYTES;
+const RELEASE_LOCK_RETRIES = 1000;
+const RELEASE_LOCK_WAIT = new Int32Array(new SharedArrayBuffer(4));
+const RELEASE_LOCK_STALE_AFTER_MS = 30_000;
+const RELEASE_CHECKPOINT_MAX_BYTES = 64 * 1024;
 const FAKE_TRANSPORT_CAPABILITIES = new WeakMap();
+const RELEASE_TRANSPORT_CAPABILITIES = new WeakMap();
+const AUTHORIZATION_VERIFIER_CAPABILITIES = new WeakMap();
+const SMOKE_VERIFIER_CAPABILITIES = new WeakMap();
+const RELEASE_STATE_AUTHORITY_CAPABILITIES = new WeakMap();
+const RELEASE_SECURITY_TEST_HOOKS = Symbol.for('chati.release-lane.security-test-hooks');
+
+function runSecurityTestHook(name, detail) {
+  const hook = globalThis[RELEASE_SECURITY_TEST_HOOKS]?.[name];
+  if (typeof hook === 'function') hook(detail);
+}
 
 function fail(code, message, details = {}) { throw new ContractError(code, message, details); }
 
@@ -34,55 +59,1160 @@ function deepFreeze(value) {
   }
   return value;
 }
-function freezeData(value, code = 'UNSAFE_DATA', label = 'value') { plainData(value, code, label); return deepFreeze(canonicalize(value)); }
-function object(value, code, label) { plainData(value, code, label); if (!value || typeof value !== 'object' || Array.isArray(value)) fail(code, `${label} must be an object`); }
-function string(value, code, label) { if (typeof value !== 'string' || value.trim() === '') fail(code, `${label} must be a non-empty string`); }
-function strings(value, code, label, { empty = false } = {}) { plainData(value, code, label); if (!Array.isArray(value) || (!empty && value.length === 0) || !value.every((item) => typeof item === 'string' && item.trim())) fail(code, `${label} must be an array of non-empty strings`); }
+
+function freezeData(value, code = 'UNSAFE_DATA', label = 'value') {
+  plainData(value, code, label);
+  return deepFreeze(canonicalize(value));
+}
+function object(value, code, label) {
+  plainData(value, code, label);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(code, `${label} must be an object`);
+}
+function string(value, code, label) {
+  if (typeof value !== 'string' || value.trim() === '') fail(code, `${label} must be a non-empty string`);
+}
+function strings(value, code, label, { empty = false } = {}) {
+  plainData(value, code, label);
+  if (!Array.isArray(value) || (!empty && value.length === 0)
+    || !value.every((item) => typeof item === 'string' && item.trim())) {
+    fail(code, `${label} must be an array of non-empty strings`);
+  }
+}
+function boundedData(value, code, label, maxBytes = RELEASE_INPUT_MAX_BYTES) {
+  const bytes = Buffer.byteLength(JSON.stringify(value));
+  if (bytes > maxBytes) fail(code, `${label} exceeds the ${maxBytes}-byte safety limit`);
+}
 function at(clock) {
   if (typeof clock !== 'function') fail('MISSING_CLOCK', 'a deterministic clock is required');
   const result = clock();
   const iso = result instanceof Date ? result.toISOString() : result;
-  if (typeof iso !== 'string' || !RFC3339.test(iso) || Number.isNaN(Date.parse(iso))) fail('INVALID_CLOCK', 'clock must return a valid RFC3339 timestamp or Date');
+  if (typeof iso !== 'string' || !RFC3339.test(iso) || Number.isNaN(Date.parse(iso))) {
+    fail('INVALID_CLOCK', 'clock must return a valid RFC3339 timestamp or Date');
+  }
   return iso;
 }
-function releaseScope(request) { return freezeData({ action: 'release', environment: request.environment, release_attempt_id: request.release_attempt_id, release_plan_ref: request.release_plan_ref, rollback_plan_ref: request.rollback_plan_ref, source_completion_refs: [...request.source_completion_refs] }); }
-function rollbackScope(request) { return freezeData({ action: 'rollback', release_attempt_id: request.release_attempt_id, rollback_attempt_id: request.rollback_attempt_id, rollback_plan_ref: request.rollback_plan_ref }); }
-function authorization(input, scopeHash) {
+
+function releaseScope(request, authorityContext = null) {
+  return freezeData({
+    action: 'release', environment: request.environment,
+    release_attempt_id: request.release_attempt_id,
+    release_plan_ref: request.release_plan_ref,
+    rollback_plan_ref: request.rollback_plan_ref,
+    source_completion_refs: [...request.source_completion_refs],
+    ...(authorityContext ? { authority_context: authorityContext } : {}),
+  });
+}
+function rollbackScope(request, authorityContext = null) {
+  return freezeData({
+    action: 'rollback', release_attempt_id: request.release_attempt_id,
+    rollback_attempt_id: request.rollback_attempt_id,
+    rollback_plan_ref: request.rollback_plan_ref,
+    ...(authorityContext ? { authority_context: authorityContext } : {}),
+  });
+}
+
+export function signedHumanAuthorizationPayload(input = {}) {
+  return freezeData({
+    schema_version: 1,
+    authorization_id: input.authorization_id,
+    actor_type: input.actor_type,
+    authorized_by: input.authorized_by,
+    authorized_at: input.authorized_at,
+    issuer_id: input.issuer_id,
+    scope_hash: input.scope_hash,
+  }, 'INVALID_HUMAN_AUTHORIZATION', 'authorization payload');
+}
+
+export function signedSmokeEvidencePayload(input = {}) {
+  return freezeData({
+    schema_version: 1,
+    evidence_id: input.evidence_id,
+    issuer_id: input.issuer_id,
+    observed_at: input.observed_at,
+    verdict: input.verdict,
+    evidence_refs: input.evidence_refs,
+    operation_scope_hash: input.operation_scope_hash,
+    environment: input.environment,
+    commit_refs: input.commit_refs,
+  });
+}
+
+export function signedReleaseReceiptPayload(input = {}) {
+  return freezeData({
+    schema_version: 1,
+    receipt_ref: input.receipt_ref,
+    deployment_ref: input.deployment_ref,
+    issuer_id: input.issuer_id,
+    transport_id: input.transport_id,
+    operation: input.operation,
+    operation_scope_hash: input.operation_scope_hash,
+    environment: input.environment,
+    idempotency_key: input.idempotency_key,
+    observed_at: input.observed_at,
+  }, 'INVALID_RELEASE_RECEIPT', 'release receipt payload');
+}
+
+/** Verifies receipts signed by a human boundary outside the model process. */
+export class SignedHumanAuthorizationVerifier {
+  constructor({ issuer_id, public_key } = {}) {
+    string(issuer_id, 'INVALID_AUTHORIZATION_VERIFIER', 'issuer_id');
+    if (!public_key) fail('INVALID_AUTHORIZATION_VERIFIER', 'public_key is required');
+    let key;
+    try {
+      key = public_key?.type === 'public' ? public_key : createPublicKey(public_key);
+      if (key.type !== 'public' || key.asymmetricKeyType !== 'ed25519') throw new Error('not an Ed25519 public key');
+    } catch {
+      fail('INVALID_AUTHORIZATION_VERIFIER', 'public_key must be a valid public key');
+    }
+    AUTHORIZATION_VERIFIER_CAPABILITIES.set(this, Object.freeze({ issuer_id, key }));
+    Object.freeze(this);
+  }
+}
+
+export class SignedSmokeEvidenceVerifier {
+  constructor({ issuer_id, public_key } = {}) {
+    string(issuer_id, 'INVALID_SMOKE_VERIFIER', 'issuer_id');
+    let key;
+    try {
+      key = public_key?.type === 'public' ? public_key : createPublicKey(public_key);
+    } catch {
+      fail('INVALID_SMOKE_VERIFIER', 'public_key must be a valid Ed25519 public key');
+    }
+    if (key.asymmetricKeyType !== 'ed25519' || key.type !== 'public') fail('INVALID_SMOKE_VERIFIER', 'public_key must be Ed25519');
+    SMOKE_VERIFIER_CAPABILITIES.set(this, Object.freeze({ production: true, issuer_id, key }));
+    Object.freeze(this);
+  }
+}
+
+export class FakeSmokeEvidenceVerifier {
+  constructor() {
+    SMOKE_VERIFIER_CAPABILITIES.set(this, Object.freeze({
+      production: false,
+      verify: (input) => input?.verdict === 'passed' && Array.isArray(input?.evidence_refs) && input.evidence_refs.length > 0,
+    }));
+    Object.freeze(this);
+  }
+}
+
+/** Host-anchored signer/verifier for durable release journal records. */
+export class ReleaseStateAuthority {
+  constructor({ sign: signRecord, verify: verifyRecord } = {}) {
+    if (typeof signRecord !== 'function' || typeof verifyRecord !== 'function') {
+      fail('INVALID_RELEASE_STATE_AUTHORITY', 'release state authority requires sign and verify callbacks');
+    }
+    RELEASE_STATE_AUTHORITY_CAPABILITIES.set(this, Object.freeze({ signRecord, verifyRecord }));
+    Object.freeze(this);
+  }
+}
+
+const AUTHORIZATION_MAX_AGE_MS = 30 * 60 * 1000;
+const AUTHORIZATION_FUTURE_SKEW_MS = 5 * 60 * 1000;
+const RELEASE_RECEIPT_CLOCK_SKEW_MS = 5 * 60 * 1000;
+
+function authorizationFreshAt(input, referenceTime) {
+  const referenceMs = Date.parse(referenceTime);
+  const authorizedMs = Date.parse(input?.authorized_at);
+  return Number.isFinite(referenceMs) && Number.isFinite(authorizedMs)
+    && authorizedMs <= referenceMs + AUTHORIZATION_FUTURE_SKEW_MS
+    && referenceMs - authorizedMs <= AUTHORIZATION_MAX_AGE_MS;
+}
+
+function assertReleaseReceiptTime(receipt, attempt, referenceTime, {
+  code = 'RELEASE_RECEIPT_TIME_MISMATCH',
+  message = 'release receipt time is not ordered after authorization or is future-dated',
+} = {}) {
+  const referenceMs = Date.parse(referenceTime);
+  const observedMs = Date.parse(receipt?.observed_at);
+  const authorizedMs = Date.parse(attempt?.authorization?.authorized_at);
+  if (!Number.isFinite(referenceMs) || !Number.isFinite(observedMs) || !Number.isFinite(authorizedMs)
+    || observedMs > referenceMs + RELEASE_RECEIPT_CLOCK_SKEW_MS
+    || observedMs < authorizedMs - RELEASE_RECEIPT_CLOCK_SKEW_MS) {
+    fail(code, message);
+  }
+}
+
+function authorization(input, scopeHash, verifier, consumedAuthorizationIds, clock) {
   object(input, 'MISSING_HUMAN_AUTHORIZATION', 'authorization');
-  if (input.actor_type === undefined) fail('MISSING_HUMAN_AUTHORIZATION', 'authorization.actor_type is required');
+  const capability = AUTHORIZATION_VERIFIER_CAPABILITIES.get(verifier);
+  if (!capability) fail('UNTRUSTED_AUTHORIZATION_VERIFIER', 'a signed human authorization verifier is required');
+  for (const field of ['authorization_id', 'authorized_by', 'authorized_at', 'issuer_id', 'scope_hash', 'signature']) {
+    string(input[field], 'INVALID_HUMAN_AUTHORIZATION', `authorization.${field}`);
+  }
   if (input.actor_type !== 'human') fail('AUTHORIZATION_ACTOR_NOT_HUMAN', 'release authorization must be issued by a human actor');
-  string(input.authorized_by, 'MISSING_HUMAN_AUTHORIZATION', 'authorization.authorized_by');
-  string(input.authorized_at, 'INVALID_HUMAN_AUTHORIZATION', 'authorization.authorized_at');
-  if (!RFC3339.test(input.authorized_at) || Number.isNaN(Date.parse(input.authorized_at))) fail('INVALID_HUMAN_AUTHORIZATION', 'authorization.authorized_at must be RFC3339');
-  string(input.scope_hash, 'MISSING_HUMAN_AUTHORIZATION', 'authorization.scope_hash');
+  if (!RFC3339.test(input.authorized_at) || Number.isNaN(Date.parse(input.authorized_at))) {
+    fail('INVALID_HUMAN_AUTHORIZATION', 'authorization.authorized_at must be RFC3339');
+  }
+  const current = clock();
+  const referenceTime = current instanceof Date ? current.toISOString() : current;
+  if (!authorizationFreshAt(input, referenceTime)) {
+    fail('HUMAN_AUTHORIZATION_EXPIRED', 'release authorization must be recent and cannot be future-dated');
+  }
   if (input.scope_hash !== scopeHash) fail('AUTHORIZATION_SCOPE_MISMATCH', 'authorization scope_hash does not match the immutable operation scope');
+  if (input.issuer_id !== capability.issuer_id) fail('AUTHORIZATION_ISSUER_MISMATCH', 'authorization issuer is not trusted by this release lane');
+  if (consumedAuthorizationIds.has(input.authorization_id)) fail('AUTHORIZATION_ALREADY_CONSUMED', 'authorization receipt was already consumed');
+  boundedData(input, 'INVALID_HUMAN_AUTHORIZATION', 'authorization', 32 * 1024);
+  const payload = signedHumanAuthorizationPayload(input);
+  let valid;
+  try {
+    valid = verifySignature(null, Buffer.from(JSON.stringify(payload)), capability.key, Buffer.from(input.signature, 'base64'));
+  } catch { valid = false; }
+  if (!valid) fail('INVALID_HUMAN_AUTHORIZATION_SIGNATURE', 'authorization signature is invalid');
   return freezeData(input, 'INVALID_HUMAN_AUTHORIZATION', 'authorization');
 }
-function smoke(input) { object(input, 'MISSING_SMOKE_EVIDENCE', 'smoke'); if (input.verdict !== 'passed') fail('SMOKE_EVIDENCE_FAILED', 'release or rollback requires passed smoke evidence'); strings(input.evidence_refs, 'MISSING_SMOKE_EVIDENCE', 'smoke.evidence_refs'); return freezeData(input, 'MISSING_SMOKE_EVIDENCE', 'smoke'); }
-function fakeAdapter(adapter) { const capability = FAKE_TRANSPORT_CAPABILITIES.get(adapter); if (!capability) fail('EXTERNAL_TRANSPORT_FORBIDDEN', 'G3 release lane accepts only a capability minted by FakeReleaseTransport'); return capability; }
 
-/** C-11 fixture-only release authority. No network, credentials, Git command or deployment command exists here. */
+const SMOKE_MAX_AGE_MS = 30 * 60 * 1000;
+const SMOKE_FUTURE_SKEW_MS = 5 * 60 * 1000;
+
+function smoke(input, { attempt, release, verifier, clock, consumedEvidenceIds }) {
+  object(input, 'MISSING_SMOKE_EVIDENCE', 'smoke');
+  const capability = SMOKE_VERIFIER_CAPABILITIES.get(verifier);
+  if (!capability) fail('UNTRUSTED_SMOKE_VERIFIER', 'smoke evidence requires an issuer-anchored verifier');
+  if (input.verdict !== 'passed') fail('SMOKE_EVIDENCE_FAILED', 'release or rollback requires passed smoke evidence');
+  strings(input.evidence_refs, 'MISSING_SMOKE_EVIDENCE', 'smoke.evidence_refs');
+  const expectedRelease = release ?? attempt;
+  const expectedCommits = [...new Set((expectedRelease.verified_completions || []).map((item) => item.result_commit_ref))].sort();
+  if (capability.production) {
+    strings(input.commit_refs, 'MISSING_SMOKE_EVIDENCE', 'smoke.commit_refs');
+    for (const field of ['evidence_id', 'issuer_id', 'observed_at', 'operation_scope_hash', 'environment', 'signature']) {
+      string(input[field], 'MISSING_SMOKE_EVIDENCE', `smoke.${field}`);
+    }
+    if (input.operation_scope_hash !== attempt.scope_hash) fail('SMOKE_SCOPE_MISMATCH', 'smoke evidence is not bound to the operation scope');
+    if (input.environment !== expectedRelease.environment) fail('SMOKE_ENVIRONMENT_MISMATCH', 'smoke evidence is not bound to the release environment');
+    if (sha256([...input.commit_refs].sort()) !== sha256(expectedCommits)) fail('SMOKE_COMMIT_MISMATCH', 'smoke evidence is not bound to the released commits');
+    if (input.issuer_id !== capability.issuer_id) fail('SMOKE_ISSUER_MISMATCH', 'smoke evidence issuer is not trusted');
+    const now = clock();
+    const nowMs = (now instanceof Date ? now : new Date(now)).getTime();
+    const observedMs = Date.parse(input.observed_at);
+    if (!Number.isFinite(nowMs) || !Number.isFinite(observedMs)
+      || observedMs > nowMs + SMOKE_FUTURE_SKEW_MS
+      || nowMs - observedMs > SMOKE_MAX_AGE_MS) {
+      fail('SMOKE_EVIDENCE_EXPIRED', 'smoke evidence must be recent and cannot be future-dated');
+    }
+    if (consumedEvidenceIds.has(input.evidence_id)) fail('SMOKE_EVIDENCE_ALREADY_CONSUMED', 'smoke evidence was already consumed by a release operation');
+    let valid;
+    try {
+      valid = verifySignature(null, Buffer.from(JSON.stringify(signedSmokeEvidencePayload(input))), capability.key, Buffer.from(input.signature, 'base64'));
+    } catch { valid = false; }
+    if (!valid) fail('INVALID_SMOKE_SIGNATURE', 'smoke evidence signature is invalid');
+  } else if (capability.verify(input, { attempt, release: expectedRelease, expected_commits: expectedCommits }) !== true) {
+    fail('INVALID_SMOKE_EVIDENCE', 'fake smoke evidence verifier rejected the fixture');
+  }
+  boundedData(input, 'MISSING_SMOKE_EVIDENCE', 'smoke', 64 * 1024);
+  return freezeData(input, 'MISSING_SMOKE_EVIDENCE', 'smoke');
+}
+
+function releaseTransport(adapter) {
+  const capability = RELEASE_TRANSPORT_CAPABILITIES.get(adapter) ?? FAKE_TRANSPORT_CAPABILITIES.get(adapter);
+  if (!capability) fail('UNMINTED_RELEASE_TRANSPORT', 'release lane accepts only a minted release transport capability');
+  return capability;
+}
+
+function lockName(name) { return `${name}.lock`; }
+
+function sameIdentity(left, right) {
+  return left?.dev === right?.dev && left?.ino === right?.ino;
+}
+
+function sameSnapshot(left, right) {
+  return sameIdentity(left, right)
+    && left?.size === right?.size
+    && left?.mode === right?.mode
+    && left?.uid === right?.uid
+    && left?.gid === right?.gid
+    && left?.nlink === right?.nlink
+    && left?.mtimeMs === right?.mtimeMs
+    && left?.ctimeMs === right?.ctimeMs;
+}
+
+function descriptorDirectoryPath(descriptor) {
+  return `/proc/self/fd/${descriptor}`;
+}
+
+function openPinnedReleaseDirectory(path, { create = false } = {}) {
+  const absolute = resolve(path);
+  if (process.platform !== 'linux') {
+    fail(
+      'UNSUPPORTED_RELEASE_STATE_PLATFORM',
+      'durable release state requires descriptor-relative filesystem access, which is supported only on Linux',
+    );
+  }
+  const root = parse(absolute).root;
+  const segments = absolute.slice(root.length).split(sep).filter(Boolean);
+  let descriptor = openSync(root, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  try {
+    for (const segment of segments) {
+      const childPath = join(descriptorDirectoryPath(descriptor), segment);
+      let childDescriptor;
+      try {
+        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      } catch (error) {
+        if (error?.code !== 'ENOENT' || !create) {
+          if (['ELOOP', 'ENOTDIR'].includes(error?.code)) {
+            fail('UNSAFE_RELEASE_STATE_DIRECTORY', 'release state directory chain must contain only real directories');
+          }
+          throw error;
+        }
+        try { mkdirSync(childPath, { mode: 0o700 }); }
+        catch (mkdirError) { if (mkdirError?.code !== 'EEXIST') throw mkdirError; }
+        childDescriptor = openSync(childPath, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+      }
+      const childStat = fstatSync(childDescriptor);
+      if (!childStat.isDirectory()) {
+        closeSync(childDescriptor);
+        fail('UNSAFE_RELEASE_STATE_DIRECTORY', 'release state directory chain must contain only real directories');
+      }
+      closeSync(descriptor);
+      descriptor = childDescriptor;
+    }
+    return Object.freeze({
+      absolute, descriptor, identity: fstatSync(descriptor),
+      reference: descriptorDirectoryPath(descriptor),
+    });
+  } catch (error) {
+    closeSync(descriptor);
+    throw error;
+  }
+}
+
+function assertPinnedReleaseDirectory(storage) {
+  const descriptorStat = fstatSync(storage.descriptor);
+  let canonical;
+  try { canonical = openPinnedReleaseDirectory(storage.absolute); }
+  catch { fail('UNSAFE_RELEASE_STATE_DIRECTORY', 'release state directory became unreachable or unsafe during the operation'); }
+  const pathStat = canonical.identity;
+  if (!descriptorStat.isDirectory() || !sameIdentity(descriptorStat, storage.identity)
+    || !pathStat.isDirectory() || !sameIdentity(pathStat, storage.identity)) {
+    closeSync(canonical.descriptor);
+    fail('UNSAFE_RELEASE_STATE_DIRECTORY', 'release state directory changed during the operation');
+  }
+  closeSync(canonical.descriptor);
+}
+
+function releaseEntryPath(storage, name) {
+  if (basename(name) !== name || name === '.' || name === '..') {
+    fail('UNSAFE_RELEASE_STATE_FILE', 'release state entry must be one path segment');
+  }
+  return join(storage.reference, name);
+}
+
+function openReleaseEntry(storage, name, flags, mode) {
+  try { return openSync(releaseEntryPath(storage, name), flags, mode); }
+  catch (error) {
+    if (['ELOOP', 'ENXIO', 'EISDIR'].includes(error?.code)) {
+      fail('UNSAFE_RELEASE_STATE_FILE', 'release state must not be a symlink, FIFO or directory');
+    }
+    throw error;
+  }
+}
+
+function checkpointName(stateName) { return `${stateName}.checkpoint`; }
+
+function releaseAnchor(records) {
+  return Object.freeze({
+    record_count: records.length,
+    last_sequence: records.at(-1)?.sequence ?? 0,
+    chain_hash: records.at(-1)?.chain_hash ?? 'GENESIS',
+  });
+}
+
+function recordAnchor(record) {
+  return Object.freeze({
+    record_count: record.sequence,
+    last_sequence: record.sequence,
+    chain_hash: record.chain_hash,
+  });
+}
+
+function priorRecordAnchor(record) {
+  return Object.freeze({
+    record_count: record.sequence - 1,
+    last_sequence: record.sequence - 1,
+    chain_hash: record.previous_hash,
+  });
+}
+
+function sameReleaseAnchor(left, right) {
+  return Boolean(left && right
+    && left.record_count === right.record_count
+    && left.last_sequence === right.last_sequence
+    && left.chain_hash === right.chain_hash);
+}
+
+function readReleaseEntryBounded(storage, name, maxBytes, { allowMissing = false } = {}) {
+  assertPinnedReleaseDirectory(storage);
+  let fd;
+  try {
+    fd = openReleaseEntry(storage, name, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  } catch (error) {
+    if (allowMissing && error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1) fail('INVALID_RELEASE_STATE', 'release state metadata must be a regular single-link file');
+    if (stat.size > maxBytes) fail('INVALID_RELEASE_STATE', 'release state metadata exceeds its safety limit');
+    const buffer = Buffer.allocUnsafe(maxBytes + 1);
+    let total = 0;
+    while (total < buffer.length) {
+      const bytesRead = readSync(fd, buffer, total, buffer.length - total, null);
+      if (bytesRead === 0) break;
+      total += bytesRead;
+    }
+    if (total > maxBytes) fail('INVALID_RELEASE_STATE', 'release state metadata exceeds its safety limit');
+    const after = fstatSync(fd);
+    if (!sameSnapshot(stat, after)) fail('RELEASE_STATE_CONFLICT', 'release state metadata changed while it was read');
+    assertPinnedReleaseDirectory(storage);
+    return buffer.subarray(0, total).toString('utf8');
+  } finally { closeSync(fd); }
+}
+
+function writeReleaseCheckpoint(storage, stateName, checkpoint) {
+  const bytes = Buffer.from(JSON.stringify(checkpoint));
+  if (bytes.length > RELEASE_CHECKPOINT_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release checkpoint exceeds its safety limit');
+  const targetName = checkpointName(stateName);
+  const temporaryName = `${targetName}.${process.pid}.${randomUUID()}.tmp`;
+  const temporaryPath = releaseEntryPath(storage, temporaryName);
+  const targetPath = releaseEntryPath(storage, targetName);
+  let fd;
+  try {
+    assertPinnedReleaseDirectory(storage);
+    fd = openReleaseEntry(
+      storage, temporaryName,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0),
+      0o600,
+    );
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(fd, bytes, offset, bytes.length - offset);
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    assertPinnedReleaseDirectory(storage);
+    renameSync(temporaryPath, targetPath);
+    fsyncSync(storage.descriptor);
+    assertPinnedReleaseDirectory(storage);
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    try { unlinkSync(temporaryPath); } catch { /* temporary may already be renamed or absent */ }
+  }
+}
+
+function parseReleaseCheckpoint(raw) {
+  let checkpoint;
+  try { checkpoint = JSON.parse(raw); }
+  catch { return fail('CORRUPT_RELEASE_STATE', 'release checkpoint contains malformed JSON'); }
+  object(checkpoint, 'CORRUPT_RELEASE_STATE', 'release checkpoint');
+  if (checkpoint.schema_version !== 1) fail('CORRUPT_RELEASE_STATE', 'release checkpoint schema is unsupported');
+  object(checkpoint.committed, 'CORRUPT_RELEASE_STATE', 'release checkpoint committed anchor');
+  if (checkpoint.pending !== null) object(checkpoint.pending, 'CORRUPT_RELEASE_STATE', 'release checkpoint pending anchor');
+  for (const [label, anchor] of [['committed', checkpoint.committed], ['pending', checkpoint.pending]]) {
+    if (anchor === null) continue;
+    if (!Number.isSafeInteger(anchor.record_count) || anchor.record_count < 0
+      || !Number.isSafeInteger(anchor.last_sequence) || anchor.last_sequence !== anchor.record_count
+      || typeof anchor.chain_hash !== 'string' || !anchor.chain_hash) {
+      fail('CORRUPT_RELEASE_STATE', `release checkpoint ${label} anchor is invalid`);
+    }
+  }
+  return checkpoint;
+}
+
+function processIsAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
+}
+
+function readLockOwner(storage, name, { assertCanonical = true } = {}) {
+  try {
+    if (assertCanonical) assertPinnedReleaseDirectory(storage);
+    const fd = openReleaseEntry(storage, name, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+    try {
+      const stat = fstatSync(fd);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.size > 16 * 1024) return null;
+      const buffer = Buffer.allocUnsafe((16 * 1024) + 1);
+      let total = 0;
+      while (total < buffer.length) {
+        const bytesRead = readSync(fd, buffer, total, buffer.length - total, null);
+        if (bytesRead === 0) break;
+        total += bytesRead;
+      }
+      if (total > 16 * 1024 || !sameSnapshot(stat, fstatSync(fd))) return null;
+      const owner = JSON.parse(buffer.subarray(0, total).toString('utf8'));
+      return owner && typeof owner === 'object' && typeof owner.token === 'string' ? owner : null;
+    } finally { closeSync(fd); }
+  } catch { return null; }
+}
+
+function recoverStaleLock(storage, name) {
+  assertPinnedReleaseDirectory(storage);
+  const path = releaseEntryPath(storage, name);
+  let stat;
+  try { stat = lstatSync(path); } catch (error) { return error?.code === 'ENOENT'; }
+  if (stat.isSymbolicLink() || !stat.isFile() || stat.nlink !== 1) return false;
+  const owner = readLockOwner(storage, name);
+  if (owner?.hostname === hostname() && processIsAlive(owner.pid)) return false;
+  // A PID from another host cannot be proven dead locally. Never steal a
+  // remote lock automatically; explicit operator reconciliation is required.
+  if (owner?.hostname && owner.hostname !== hostname()) return false;
+  if (!owner && Date.now() - stat.mtimeMs < RELEASE_LOCK_STALE_AFTER_MS) return false;
+  const recoveryName = `${name}.recovery`;
+  const recoveryPath = releaseEntryPath(storage, recoveryName);
+  let recoveryFd;
+  try {
+    recoveryFd = openSync(recoveryPath, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+    const bytes = Buffer.from(JSON.stringify({ pid: process.pid, hostname: hostname(), token: randomUUID() }));
+    writeSync(recoveryFd, bytes, 0, bytes.length);
+    fsyncSync(recoveryFd);
+  } catch {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    return false;
+  }
+  const quarantineName = `${name}.stale.${process.pid}.${randomUUID()}`;
+  const quarantine = releaseEntryPath(storage, quarantineName);
+  try {
+    const current = lstatSync(path);
+    const currentOwner = readLockOwner(storage, name);
+    if (!sameIdentity(stat, current) || currentOwner?.token !== owner?.token) return false;
+    renameSync(path, quarantine);
+    const quarantined = lstatSync(quarantine);
+    const quarantinedOwner = readLockOwner(storage, quarantineName);
+    if (!sameIdentity(stat, quarantined) || quarantinedOwner?.token !== owner?.token) {
+      try { if (!existsSync(path)) renameSync(quarantine, path); } catch { /* preserve quarantine fail-closed */ }
+      return false;
+    }
+    unlinkSync(quarantine);
+    return true;
+  } catch (error) { return error?.code === 'ENOENT'; }
+  finally {
+    if (recoveryFd !== undefined) closeSync(recoveryFd);
+    try { unlinkSync(recoveryPath); } catch { /* fail closed if recovery ownership changed */ }
+  }
+}
+
+function acquireReleaseLock(statePath) {
+  const storage = openPinnedReleaseDirectory(dirname(statePath), { create: true });
+  const stateName = basename(statePath);
+  const name = lockName(stateName);
+  const path = releaseEntryPath(storage, name);
+  let fd;
+  let token;
+  try {
+    for (let retry = 0; retry < RELEASE_LOCK_RETRIES; retry += 1) {
+      assertPinnedReleaseDirectory(storage);
+      let candidate;
+      try {
+        candidate = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+      } catch (error) {
+        if (error?.code !== 'EEXIST') throw error;
+        if (recoverStaleLock(storage, name)) continue;
+        Atomics.wait(RELEASE_LOCK_WAIT, 0, 0, 10);
+        continue;
+      }
+      token = `${process.pid}-${Date.now()}-${randomUUID()}`;
+      try {
+        const bytes = Buffer.from(JSON.stringify({ schema_version: 1, pid: process.pid, hostname: hostname(), token, acquired_at: new Date().toISOString() }));
+        writeSync(candidate, bytes, 0, bytes.length);
+        fsyncSync(candidate);
+        fsyncSync(storage.descriptor);
+        fd = candidate;
+        break;
+      } catch (error) {
+        closeSync(candidate);
+        try { unlinkSync(path); } catch { /* the acquisition failed closed */ }
+        throw error;
+      }
+    }
+    if (fd === undefined) fail('RELEASE_STATE_LOCK_BUSY', 'release state mutation lock is already held');
+  } catch (error) {
+    closeSync(storage.descriptor);
+    throw error;
+  }
+  return Object.freeze({
+    storage,
+    release() {
+      closeSync(fd);
+      let safetyError = null;
+      try { assertPinnedReleaseDirectory(storage); } catch (error) { safetyError = error; }
+      try {
+        if (readLockOwner(storage, name, { assertCanonical: false })?.token === token) {
+          unlinkSync(path);
+          fsyncSync(storage.descriptor);
+        }
+      } finally { closeSync(storage.descriptor); }
+      if (safetyError) throw safetyError;
+    },
+  });
+}
+
+function appendDurable(path, record, expectedIdentity, storage, stateAuthority, requireAuthenticatedState) {
+  const bytes = Buffer.from(`${JSON.stringify(record)}\n`);
+  if (bytes.length > RELEASE_RECORD_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release state record exceeds the 4 MiB safety limit');
+  if (!storage) fail('MISSING_RELEASE_STATE_STORAGE', 'durable release append requires a pinned storage directory');
+  const name = basename(path);
+  const existed = expectedIdentity !== null;
+  writeReleaseCheckpoint(storage, name, Object.freeze({
+    schema_version: 1,
+    committed: priorRecordAnchor(record),
+    pending: recordAnchor(record),
+  }));
+  runSecurityTestHook('beforeReleaseAppend', { path });
+  assertPinnedReleaseDirectory(storage);
+  let fd;
+  try {
+    fd = openReleaseEntry(storage, name, constants.O_WRONLY | constants.O_APPEND
+      | (existed ? 0 : constants.O_CREAT | constants.O_EXCL)
+      | (constants.O_NOFOLLOW || 0), 0o600);
+  } catch (error) {
+    if (!existed && error?.code === 'EEXIST') fail('RELEASE_STATE_CONFLICT', 'release state appeared after it was loaded');
+    throw error;
+  }
+  let identity;
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1) fail('INVALID_RELEASE_STATE', 'release state must be a regular single-link file');
+    if (existed && !sameSnapshot(stat, expectedIdentity)) fail('RELEASE_STATE_CONFLICT', 'release state changed between load and append');
+    if (stat.size + bytes.length > RELEASE_STATE_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release state exceeds the 64 MiB safety limit');
+    let offset = 0;
+    while (offset < bytes.length) offset += writeSync(fd, bytes, offset, bytes.length - offset);
+    fsyncSync(fd);
+    const after = fstatSync(fd);
+    if (!sameIdentity(stat, after)
+      || after.mode !== stat.mode || after.uid !== stat.uid || after.gid !== stat.gid
+      || after.nlink !== stat.nlink || after.size !== stat.size + bytes.length) {
+      fail('RELEASE_STATE_CONFLICT', 'release state changed during append');
+    }
+    identity = after;
+  } finally { closeSync(fd); }
+  fsyncSync(storage.descriptor);
+  assertPinnedReleaseDirectory(storage);
+  const verified = readDurable(path, storage, stateAuthority, requireAuthenticatedState);
+  if (verified.records.at(-1)?.chain_hash !== record.chain_hash
+    || verified.records.at(-1)?.sequence !== record.sequence) {
+    fail('RELEASE_STATE_CONFLICT', 'release state content changed during append');
+  }
+  return verified.identity ?? identity;
+}
+
+function assertExternalCapacity(path, storage, expectedIdentity) {
+  if (!path) return;
+  if (!storage) fail('MISSING_RELEASE_STATE_STORAGE', 'external release requires pinned durable storage');
+  assertPinnedReleaseDirectory(storage);
+  let fd;
+  try { fd = openReleaseEntry(storage, basename(path), constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0)); }
+  catch (error) { if (error?.code === 'ENOENT') return; throw error; }
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1) fail('INVALID_RELEASE_STATE', 'release state must be a regular single-link file');
+    if (expectedIdentity && !sameSnapshot(stat, expectedIdentity)) {
+      fail('RELEASE_STATE_CONFLICT', 'release state changed before the external boundary');
+    }
+    if (stat.size > RELEASE_STATE_MAX_BYTES - RELEASE_EXTERNAL_RESERVE_BYTES) {
+      fail('RELEASE_STATE_CAPACITY_EXHAUSTED', 'release state lacks reserved capacity for an external intent and its outcome');
+    }
+  } finally { closeSync(fd); }
+  assertPinnedReleaseDirectory(storage);
+}
+
+function readDurable(path, storage, stateAuthority = null, requireAuthenticatedState = false) {
+  if (!path) return { records: [], identity: null };
+  if (!storage) fail('MISSING_RELEASE_STATE_STORAGE', 'durable release read requires a pinned storage directory');
+  assertPinnedReleaseDirectory(storage);
+  const stateName = basename(path);
+  let fd;
+  try { fd = openReleaseEntry(storage, stateName, constants.O_RDWR | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0)); }
+  catch (error) { if (error?.code !== 'ENOENT') throw error; }
+  try {
+    const stat = fd === undefined ? null : fstatSync(fd);
+    if (stat && (!stat.isFile() || stat.nlink !== 1)) fail('INVALID_RELEASE_STATE', 'release state must be a regular single-link file');
+    if (stat?.size > RELEASE_STATE_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release state exceeds the 64 MiB safety limit');
+    if (stat) runSecurityTestHook('afterReleaseStateStat', { path });
+    const chunks = [];
+    let total = 0;
+    while (fd !== undefined) {
+      const chunk = Buffer.allocUnsafe(Math.min(64 * 1024, RELEASE_STATE_MAX_BYTES + 1 - total));
+      const bytesRead = readSync(fd, chunk, 0, chunk.length, null);
+      if (bytesRead === 0) break;
+      total += bytesRead;
+      if (total > RELEASE_STATE_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release state exceeds the 64 MiB safety limit');
+      chunks.push(chunk.subarray(0, bytesRead));
+    }
+    const after = fd === undefined ? null : fstatSync(fd);
+    if (stat && !sameSnapshot(stat, after)) fail('RELEASE_STATE_CONFLICT', 'release state changed while it was being read');
+    const raw = Buffer.concat(chunks, total).toString('utf8');
+    const complete = raw.endsWith('\n') ? raw : raw.slice(0, raw.lastIndexOf('\n') + 1);
+    let values = complete === '' ? [] : complete.slice(0, -1).split('\n').map((line) => {
+      try { return JSON.parse(line); } catch { return fail('CORRUPT_RELEASE_STATE', 'release state contains malformed JSON'); }
+    });
+    validateReleaseChain(values, stateAuthority, requireAuthenticatedState);
+    const tail = raw && !raw.endsWith('\n') ? raw.slice(raw.lastIndexOf('\n') + 1) : null;
+    let completeTail = false;
+    if (tail !== null) {
+      try {
+        const candidate = JSON.parse(tail);
+        validateReleaseChain([...values, candidate], stateAuthority, requireAuthenticatedState);
+        values = [...values, candidate];
+        completeTail = true;
+      } catch { /* a checkpoint decides whether the incomplete append is repairable */ }
+    }
+    const rawCheckpoint = readReleaseEntryBounded(
+      storage, checkpointName(stateName), RELEASE_CHECKPOINT_MAX_BYTES, { allowMissing: true },
+    );
+    const checkpoint = rawCheckpoint === null ? null : parseReleaseCheckpoint(rawCheckpoint);
+    const anchor = releaseAnchor(values);
+    const validCommitted = checkpoint !== null && sameReleaseAnchor(anchor, checkpoint.committed);
+    const validPending = checkpoint !== null && checkpoint.pending !== null
+      && sameReleaseAnchor(anchor, checkpoint.pending);
+    const incompleteTail = tail !== null && !completeTail;
+    const missingDelimiter = tail !== null && completeTail;
+    if (checkpoint && !validCommitted && !validPending) {
+      fail('RELEASE_STATE_TRUNCATION_DETECTED', 'release state does not match its durable checkpoint');
+    }
+    if (!checkpoint && (incompleteTail || missingDelimiter)) {
+      fail('CORRUPT_RELEASE_STATE', 'release state contains an uncheckpointed trailing record');
+    }
+    const safeTailRepair = incompleteTail && validCommitted && checkpoint.pending !== null;
+    if (incompleteTail && !safeTailRepair) {
+      fail('RELEASE_STATE_TRUNCATION_DETECTED', 'release state was truncated below its durable high-water mark');
+    }
+    let identity = after;
+    if (safeTailRepair) {
+      const repairedBytes = Buffer.byteLength(complete);
+      ftruncateSync(fd, repairedBytes);
+      fsyncSync(fd);
+      const repaired = fstatSync(fd);
+      if (!sameIdentity(after, repaired)
+        || repaired.mode !== after.mode || repaired.uid !== after.uid || repaired.gid !== after.gid
+        || repaired.nlink !== after.nlink || repaired.size !== repairedBytes) {
+        fail('RELEASE_STATE_CONFLICT', 'release state changed during tail repair');
+      }
+      const verify = Buffer.allocUnsafe(repairedBytes);
+      let offset = 0;
+      while (offset < verify.length) {
+        const bytesRead = readSync(fd, verify, offset, verify.length - offset, offset);
+        if (bytesRead === 0) break;
+        offset += bytesRead;
+      }
+      const verified = fstatSync(fd);
+      if (offset !== repairedBytes || verify.toString('utf8') !== complete || !sameSnapshot(repaired, verified)) {
+        fail('RELEASE_STATE_CONFLICT', 'release state tail repair could not be verified');
+      }
+      identity = verified;
+    } else if (missingDelimiter) {
+      if (after.size + 1 > RELEASE_STATE_MAX_BYTES) fail('INVALID_RELEASE_STATE', 'release state exceeds the 64 MiB safety limit');
+      const newline = Buffer.from('\n');
+      const written = writeSync(fd, newline, 0, newline.length, after.size);
+      if (written !== newline.length) fail('RELEASE_STATE_CONFLICT', 'release state delimiter repair was incomplete');
+      fsyncSync(fd);
+      const normalized = fstatSync(fd);
+      if (!sameIdentity(after, normalized)
+        || normalized.mode !== after.mode || normalized.uid !== after.uid || normalized.gid !== after.gid
+        || normalized.nlink !== after.nlink || normalized.size !== after.size + 1) {
+        fail('RELEASE_STATE_CONFLICT', 'release state changed during delimiter repair');
+      }
+      const expected = Buffer.from(`${raw}\n`);
+      const verify = Buffer.allocUnsafe(expected.length);
+      let offset = 0;
+      while (offset < verify.length) {
+        const bytesRead = readSync(fd, verify, offset, verify.length - offset, offset);
+        if (bytesRead === 0) break;
+        offset += bytesRead;
+      }
+      const verified = fstatSync(fd);
+      if (offset !== expected.length || !verify.equals(expected) || !sameSnapshot(normalized, verified)) {
+        fail('RELEASE_STATE_CONFLICT', 'release state delimiter repair could not be verified');
+      }
+      identity = verified;
+    }
+    if (checkpoint !== null && checkpoint.pending !== null) {
+      writeReleaseCheckpoint(storage, stateName, Object.freeze({
+        schema_version: 1,
+        committed: releaseAnchor(values),
+        pending: null,
+      }));
+    }
+    if (fd === undefined && checkpoint && !sameReleaseAnchor(releaseAnchor([]), checkpoint.committed)) {
+      fail('RELEASE_STATE_TRUNCATION_DETECTED', 'release state file is missing below its durable high-water mark');
+    }
+    if (fd !== undefined) fsyncSync(storage.descriptor);
+    assertPinnedReleaseDirectory(storage);
+    return { records: values, identity };
+  } finally { if (fd !== undefined) closeSync(fd); }
+}
+
+function releaseRecordCore(value) {
+  return freezeData({
+    schema_version: value.schema_version,
+    sequence: value.sequence,
+    type: value.type,
+    occurred_at: value.occurred_at,
+    payload: value.payload,
+    record_hash: value.record_hash,
+    previous_hash: value.previous_hash,
+    chain_hash: value.chain_hash,
+  }, 'CORRUPT_RELEASE_STATE', 'release authenticated record');
+}
+
+function authenticateReleaseRecord(core, stateAuthority) {
+  if (!stateAuthority) return null;
+  const capability = RELEASE_STATE_AUTHORITY_CAPABILITIES.get(stateAuthority);
+  if (!capability) fail('INVALID_RELEASE_STATE_AUTHORITY', 'release state authority capability is not minted');
+  const receipt = capability.signRecord(core);
+  object(receipt, 'INVALID_RELEASE_STATE_AUTHORITY', 'release state authority receipt');
+  string(receipt.authority_id, 'INVALID_RELEASE_STATE_AUTHORITY', 'release state authority receipt.authority_id');
+  string(receipt.authority_signature, 'INVALID_RELEASE_STATE_AUTHORITY', 'release state authority receipt.authority_signature');
+  if (capability.verifyRecord(core, receipt) !== true) {
+    fail('INVALID_RELEASE_STATE_AUTHORITY', 'release state authority did not verify its own receipt');
+  }
+  return freezeData(receipt, 'INVALID_RELEASE_STATE_AUTHORITY', 'release state authority receipt');
+}
+
+function validateReleaseChain(values, stateAuthority = null, requireAuthenticatedState = false) {
+  let previousHash = 'GENESIS';
+  let sequence = 0;
+  const capability = stateAuthority ? RELEASE_STATE_AUTHORITY_CAPABILITIES.get(stateAuthority) : null;
+  if (requireAuthenticatedState && !capability) {
+    fail('RELEASE_STATE_AUTHORITY_REQUIRED', 'durable production release state requires a host authority');
+  }
+  for (const value of values) {
+    object(value, 'CORRUPT_RELEASE_STATE', 'release record');
+    const material = freezeData({
+      schema_version: value.schema_version, sequence: value.sequence,
+      type: value.type, occurred_at: value.occurred_at, payload: value.payload,
+    }, 'CORRUPT_RELEASE_STATE', 'release record');
+    const expectedRecordHash = sha256(material);
+    const expectedChainHash = sha256({ previous_hash: previousHash, record_hash: expectedRecordHash });
+    if (material.schema_version !== 1 || material.sequence !== sequence + 1
+      || value.previous_hash !== previousHash || value.record_hash !== expectedRecordHash
+      || value.chain_hash !== expectedChainHash) {
+      fail('CORRUPT_RELEASE_STATE', 'release state hash chain is invalid');
+    }
+    const authenticated = typeof value.authority_id === 'string'
+      && typeof value.authority_signature === 'string';
+    const expectedKeys = authenticated
+      ? ['authority_id', 'authority_signature', 'chain_hash', 'occurred_at', 'payload', 'previous_hash', 'record_hash', 'schema_version', 'sequence', 'type']
+      : ['chain_hash', 'occurred_at', 'payload', 'previous_hash', 'record_hash', 'schema_version', 'sequence', 'type'];
+    if (Object.keys(value).sort().join(',') !== expectedKeys.sort().join(',')) {
+      fail('CORRUPT_RELEASE_STATE', 'release state record has ambiguous or unsupported fields');
+    }
+    if (requireAuthenticatedState && !authenticated) {
+      fail('UNAUTHENTICATED_RELEASE_STATE', 'production release state contains an unsigned record');
+    }
+    if (authenticated) {
+      if (!capability || capability.verifyRecord(releaseRecordCore(value), {
+        authority_id: value.authority_id,
+        authority_signature: value.authority_signature,
+      }) !== true) {
+        fail('INVALID_RELEASE_STATE_SIGNATURE', 'release state record signature is invalid');
+      }
+    }
+    previousHash = value.chain_hash;
+    sequence = value.sequence;
+  }
+  return values;
+}
+
+/** Durable release and rollback authority. */
 export class ReleaseLane {
   #clock;
   #verifyCompletion;
+  #authorizationVerifier;
+  #smokeVerifier;
+  #statePath;
   #records = [];
   #releases = new Map();
   #rollbacks = new Map();
+  #consumedAuthorizationIds = new Set();
+  #consumedSmokeEvidenceIds = new Set();
+  #stateIdentity = null;
+  #activeStorage = null;
+  #requireProductionTransport;
+  #stateAuthority;
+  #requireAuthenticatedState;
+  #authorityContext;
 
-  constructor({ clock, verify_completion } = {}) {
+  constructor({
+    clock, verify_completion, authorization_verifier, smoke_verifier,
+    state_path = null, require_production_transport = false,
+    state_authority = null, require_authenticated_state = false,
+    authority_context = null, require_authority_context = false,
+  } = {}) {
     if (typeof verify_completion !== 'function') fail('MISSING_COMPLETION_VERIFIER', 'verify_completion must validate C-06 completion evidence');
+    if (!AUTHORIZATION_VERIFIER_CAPABILITIES.has(authorization_verifier)) {
+      fail('UNTRUSTED_AUTHORIZATION_VERIFIER', 'authorization_verifier must be a SignedHumanAuthorizationVerifier');
+    }
+    if (!SMOKE_VERIFIER_CAPABILITIES.has(smoke_verifier)) fail('UNTRUSTED_SMOKE_VERIFIER', 'smoke_verifier must be a SignedSmokeEvidenceVerifier');
+    if (state_path !== null) string(state_path, 'INVALID_RELEASE_STATE', 'state_path');
     this.#clock = clock;
     this.#verifyCompletion = verify_completion;
+    this.#authorizationVerifier = authorization_verifier;
+    this.#smokeVerifier = smoke_verifier;
+    this.#requireProductionTransport = require_production_transport === true;
+    if (state_authority !== null && !RELEASE_STATE_AUTHORITY_CAPABILITIES.has(state_authority)) {
+      fail('INVALID_RELEASE_STATE_AUTHORITY', 'state_authority must be a minted ReleaseStateAuthority');
+    }
+    this.#stateAuthority = state_authority;
+    this.#requireAuthenticatedState = require_authenticated_state === true;
+    if (this.#requireAuthenticatedState && !this.#stateAuthority) {
+      fail('RELEASE_STATE_AUTHORITY_REQUIRED', 'authenticated release state requires a host authority');
+    }
+    if (authority_context !== null) {
+      object(authority_context, 'INVALID_RELEASE_AUTHORITY_CONTEXT', 'authority_context');
+      for (const field of ['project_id', 'handoff_id']) {
+        string(authority_context[field], 'INVALID_RELEASE_AUTHORITY_CONTEXT', `authority_context.${field}`);
+      }
+      this.#authorityContext = freezeData(authority_context, 'INVALID_RELEASE_AUTHORITY_CONTEXT', 'authority_context');
+    } else {
+      this.#authorityContext = null;
+    }
+    if (require_authority_context === true && !this.#authorityContext) {
+      fail('RELEASE_AUTHORITY_CONTEXT_REQUIRED', 'production release scope requires project and handoff authority context');
+    }
+    this.#statePath = state_path;
+    if (this.#statePath) this.#exclusive(() => undefined);
+    else this.#load();
+  }
+
+  get records() {
+    return this.#statePath
+      ? this.#exclusive(() => freezeData([...this.#records]))
+      : freezeData([...this.#records]);
+  }
+
+  #assertReleaseIdentity(previous, next) {
+    const immutable = (value) => ({
+      release_attempt_id: value.release_attempt_id,
+      source_completion_refs: value.source_completion_refs,
+      environment: value.environment,
+      release_plan_ref: value.release_plan_ref,
+      rollback_plan_ref: value.rollback_plan_ref,
+      verified_completions: value.verified_completions,
+      scope: value.scope,
+      scope_hash: value.scope_hash,
+    });
+    if (sha256(immutable(previous)) !== sha256(immutable(next))) {
+      fail('CORRUPT_RELEASE_STATE', 'release journal changed immutable release attempt material');
+    }
+  }
+
+  #assertRollbackIdentity(previous, next) {
+    const immutable = (value) => ({
+      rollback_attempt_id: value.rollback_attempt_id,
+      release_attempt_id: value.release_attempt_id,
+      rollback_plan_ref: value.rollback_plan_ref,
+      scope: value.scope,
+      scope_hash: value.scope_hash,
+    });
+    if (sha256(immutable(previous)) !== sha256(immutable(next))) {
+      fail('CORRUPT_RELEASE_STATE', 'release journal changed immutable rollback attempt material');
+    }
+  }
+
+  #validateRecordSemantics(record) {
+    if (!RFC3339.test(record.occurred_at || '') || Number.isNaN(Date.parse(record.occurred_at))) {
+      fail('CORRUPT_RELEASE_STATE', 'release journal record timestamp is invalid');
+    }
+    object(record.payload, 'CORRUPT_RELEASE_STATE', 'release record payload');
+    const releaseTransitions = {
+      release_attempt_created: { from: null, to: 'created' },
+      release_rejected: { from: ['created'], to: 'rejected' },
+      release_intent_recorded: { from: ['created'], to: 'pending_external' },
+      release_completed: { from: ['pending_external'], to: 'released' },
+      release_sent_unconfirmed: { from: ['pending_external'], to: 'sent_unconfirmed' },
+      release_reconciled: { from: ['pending_external', 'sent_unconfirmed'], to: 'released' },
+      release_reconciled_not_found: { from: ['pending_external', 'sent_unconfirmed'], to: 'created' },
+      release_reconciliation_failed: { from: ['pending_external', 'sent_unconfirmed'], to: 'same' },
+      release_reconciliation_inconclusive: { from: ['pending_external', 'sent_unconfirmed'], to: 'same' },
+    };
+    const rollbackTransitions = {
+      rollback_attempt_created: { from: null, to: 'created' },
+      rollback_rejected: { from: ['created'], to: 'rejected' },
+      rollback_intent_recorded: { from: ['created'], to: 'pending_external' },
+      rollback_completed: { from: ['pending_external'], to: 'rolled_back' },
+      rollback_sent_unconfirmed: { from: ['pending_external'], to: 'sent_unconfirmed' },
+      rollback_reconciled: { from: ['pending_external', 'sent_unconfirmed'], to: 'rolled_back' },
+      rollback_reconciled_not_found: { from: ['pending_external', 'sent_unconfirmed'], to: 'created' },
+      rollback_reconciliation_failed: { from: ['pending_external', 'sent_unconfirmed'], to: 'same' },
+      rollback_reconciliation_inconclusive: { from: ['pending_external', 'sent_unconfirmed'], to: 'same' },
+    };
+    if (Object.hasOwn(releaseTransitions, record.type)) {
+      if (Object.keys(record.payload).filter((key) => key === 'release').length !== 1) {
+        fail('CORRUPT_RELEASE_STATE', 'release journal transition lacks one release payload');
+      }
+      const next = record.payload.release;
+      object(next, 'CORRUPT_RELEASE_STATE', 'release transition');
+      string(next.release_attempt_id, 'CORRUPT_RELEASE_STATE', 'release.release_attempt_id');
+      const previous = this.#releases.get(next.release_attempt_id) ?? null;
+      const transition = releaseTransitions[record.type];
+      if (transition.from === null ? previous !== null : !previous || !transition.from.includes(previous.state)) {
+        fail('CORRUPT_RELEASE_STATE', `invalid ${record.type} predecessor`);
+      }
+      const expectedState = transition.to === 'same' ? previous.state : transition.to;
+      if (next.state !== expectedState) fail('CORRUPT_RELEASE_STATE', `invalid ${record.type} state`);
+      if (previous) this.#assertReleaseIdentity(previous, next);
+      if (record.type === 'release_attempt_created') {
+        const expectedScope = releaseScope(next, this.#authorityContext);
+        if (sha256(next.scope) !== sha256(expectedScope) || next.scope_hash !== sha256(expectedScope)) {
+          fail('CORRUPT_RELEASE_STATE', 'release attempt scope is not canonical');
+        }
+      }
+      if (record.type === 'release_intent_recorded') {
+        if (next.idempotency_key !== sha256({ operation: 'release', scope_hash: next.scope_hash })
+          || record.payload.idempotency_key !== next.idempotency_key
+          || record.payload.authorization?.authorization_id !== next.authorization?.authorization_id
+          || next.authorization?.scope_hash !== next.scope_hash
+          || next.authorization?.actor_type !== 'human'
+          || !authorizationFreshAt(next.authorization, record.occurred_at)
+          || next.smoke?.verdict !== 'passed') {
+          fail('CORRUPT_RELEASE_STATE', 'release intent authority or idempotency binding is invalid');
+        }
+      }
+      if (['release_completed', 'release_reconciled'].includes(record.type)) {
+        const receipt = record.type === 'release_reconciled' ? record.payload.lookup?.receipt : record.payload.receipt;
+        if (!receipt || next.receipt_ref !== receipt.receipt_ref
+          || next.release_receipt?.receipt_ref !== receipt.receipt_ref
+          || (receipt.operation && receipt.operation !== 'release')
+          || (receipt.operation_scope_hash && receipt.operation_scope_hash !== next.scope_hash)
+          || (receipt.idempotency_key && receipt.idempotency_key !== next.idempotency_key)
+          || (receipt.environment && receipt.environment !== next.environment)
+          || (receipt.transport_id && receipt.transport_id !== next.transport_id)) {
+          fail('CORRUPT_RELEASE_STATE', 'release completion receipt is not bound to its attempt');
+        }
+        if (receipt.observed_at) {
+          assertReleaseReceiptTime(receipt, next, record.occurred_at, {
+            code: 'CORRUPT_RELEASE_STATE',
+            message: 'release completion receipt timestamp is inconsistent with its authorization and journal record',
+          });
+        }
+      }
+      return true;
+    }
+    if (Object.hasOwn(rollbackTransitions, record.type)) {
+      const next = record.payload.rollback;
+      object(next, 'CORRUPT_RELEASE_STATE', 'rollback transition');
+      string(next.rollback_attempt_id, 'CORRUPT_RELEASE_STATE', 'rollback.rollback_attempt_id');
+      const previous = this.#rollbacks.get(next.rollback_attempt_id) ?? null;
+      const transition = rollbackTransitions[record.type];
+      if (transition.from === null ? previous !== null : !previous || !transition.from.includes(previous.state)) {
+        fail('CORRUPT_RELEASE_STATE', `invalid ${record.type} predecessor`);
+      }
+      const expectedState = transition.to === 'same' ? previous.state : transition.to;
+      if (next.state !== expectedState) fail('CORRUPT_RELEASE_STATE', `invalid ${record.type} state`);
+      if (previous) this.#assertRollbackIdentity(previous, next);
+      const sourceRelease = this.#releases.get(next.release_attempt_id);
+      if (!sourceRelease || sourceRelease.state !== 'released') {
+        fail('CORRUPT_RELEASE_STATE', 'rollback transition lacks its released source attempt');
+      }
+      if (record.type === 'rollback_attempt_created') {
+        const expectedScope = rollbackScope(next, this.#authorityContext);
+        if (sha256(next.scope) !== sha256(expectedScope) || next.scope_hash !== sha256(expectedScope)) {
+          fail('CORRUPT_RELEASE_STATE', 'rollback attempt scope is not canonical');
+        }
+      }
+      if (record.type === 'rollback_intent_recorded') {
+        if (next.idempotency_key !== sha256({ operation: 'rollback', scope_hash: next.scope_hash })
+          || record.payload.idempotency_key !== next.idempotency_key
+          || record.payload.authorization?.authorization_id !== next.authorization?.authorization_id
+          || next.authorization?.scope_hash !== next.scope_hash
+          || next.authorization?.actor_type !== 'human'
+          || !authorizationFreshAt(next.authorization, record.occurred_at)
+          || next.smoke?.verdict !== 'passed') {
+          fail('CORRUPT_RELEASE_STATE', 'rollback intent authority or idempotency binding is invalid');
+        }
+      }
+      if (['rollback_completed', 'rollback_reconciled'].includes(record.type)) {
+        const receipt = record.type === 'rollback_reconciled' ? record.payload.lookup?.receipt : record.payload.receipt;
+        if (!receipt || next.receipt_ref !== receipt.receipt_ref
+          || next.release_receipt?.receipt_ref !== receipt.receipt_ref
+          || (receipt.operation && receipt.operation !== 'rollback')
+          || (receipt.operation_scope_hash && receipt.operation_scope_hash !== next.scope_hash)
+          || (receipt.idempotency_key && receipt.idempotency_key !== next.idempotency_key)
+          || (receipt.environment && receipt.environment !== sourceRelease.environment)
+          || (receipt.transport_id && receipt.transport_id !== next.transport_id)) {
+          fail('CORRUPT_RELEASE_STATE', 'rollback completion receipt is not bound to its attempt');
+        }
+        if (receipt.observed_at) {
+          assertReleaseReceiptTime(receipt, next, record.occurred_at, {
+            code: 'CORRUPT_RELEASE_STATE',
+            message: 'rollback completion receipt timestamp is inconsistent with its authorization and journal record',
+          });
+        }
+      }
+      return true;
+    }
+    fail('CORRUPT_RELEASE_STATE', `unsupported release journal record type ${record.type}`);
+  }
+
+  #apply(record) {
+    this.#validateRecordSemantics(record);
+    if (record.payload.release) this.#releases.set(record.payload.release.release_attempt_id, record.payload.release);
+    if (record.payload.rollback) this.#rollbacks.set(record.payload.rollback.rollback_attempt_id, record.payload.rollback);
+    if (record.type.endsWith('_intent_recorded') && record.payload.authorization?.authorization_id) {
+      this.#consumedAuthorizationIds.add(record.payload.authorization.authorization_id);
+    }
+    const smokeEvidenceId = record.payload.release?.smoke?.evidence_id ?? record.payload.rollback?.smoke?.evidence_id;
+    if (record.type.endsWith('_intent_recorded') && smokeEvidenceId) this.#consumedSmokeEvidenceIds.add(smokeEvidenceId);
+  }
+
+  #load() {
+    this.#records = [];
+    this.#releases = new Map();
+    this.#rollbacks = new Map();
+    this.#consumedAuthorizationIds = new Set();
+    this.#consumedSmokeEvidenceIds = new Set();
+    const loaded = readDurable(
+      this.#statePath, this.#activeStorage,
+      this.#stateAuthority, this.#requireAuthenticatedState,
+    );
+    this.#stateIdentity = loaded.identity;
+    for (const value of loaded.records) {
+      const record = freezeData(value, 'CORRUPT_RELEASE_STATE', 'release record');
+      this.#records.push(record);
+      this.#apply(record);
+    }
+  }
+
+  #exclusive(action) {
+    if (!this.#statePath) return action();
+    if (this.#activeStorage) fail('RELEASE_STATE_REENTRANCY', 'release state mutation cannot nest an exclusive storage operation');
+    const lock = acquireReleaseLock(this.#statePath);
+    this.#activeStorage = lock.storage;
+    try {
+      this.#load();
+      return action();
+    } finally {
+      this.#activeStorage = null;
+      lock.release();
+    }
   }
-  get records() { return freezeData([...this.#records]); }
+
   #record(type, payload) {
     const previous_hash = this.#records.at(-1)?.chain_hash ?? 'GENESIS';
     const material = freezeData({ schema_version: 1, sequence: this.#records.length + 1, type, occurred_at: at(this.#clock), payload });
-    const recordHash = sha256(material);
-    const record = freezeData({ ...material, record_hash: recordHash, previous_hash, chain_hash: sha256({ previous_hash, record_hash: recordHash }) });
+    const record_hash = sha256(material);
+    const core = freezeData({
+      ...material,
+      record_hash,
+      previous_hash,
+      chain_hash: sha256({ previous_hash, record_hash }),
+    });
+    const authority = authenticateReleaseRecord(core, this.#stateAuthority);
+    const record = freezeData({ ...core, ...(authority ?? {}) });
+    this.#validateRecordSemantics(record);
+    if (this.#statePath) {
+      this.#stateIdentity = appendDurable(
+        this.#statePath, record, this.#stateIdentity, this.#activeStorage,
+        this.#stateAuthority, this.#requireAuthenticatedState,
+      );
+    }
     this.#records.push(record);
+    this.#apply(record);
     return record;
   }
+
+  #assertExternalBoundary() {
+    if (!this.#statePath) return;
+    assertExternalCapacity(this.#statePath, this.#activeStorage, this.#stateIdentity);
+    assertPinnedReleaseDirectory(this.#activeStorage);
+  }
+
   #verifyCompletions(refs) {
     return freezeData(refs.map((ref) => {
       const completion = this.#verifyCompletion(ref);
@@ -90,82 +1220,320 @@ export class ReleaseLane {
       if (completion.state !== 'merged') fail('SOURCE_COMPLETION_NOT_MERGED', 'source completion must be C-06 merged evidence', { ref });
       string(completion.completion_id, 'UNVERIFIABLE_SOURCE_COMPLETION', `completion ${ref}.completion_id`);
       string(completion.immutable_ref, 'UNVERIFIABLE_SOURCE_COMPLETION', `completion ${ref}.immutable_ref`);
+      string(completion.git?.result_ref, 'UNVERIFIABLE_SOURCE_COMPLETION', `completion ${ref}.git.result_ref`);
       if (completion.immutable_ref !== ref) fail('SOURCE_COMPLETION_REF_MISMATCH', 'completion verifier did not bind the requested immutable reference', { ref });
-      return { completion_id: completion.completion_id, immutable_ref: completion.immutable_ref, state: completion.state };
+      return {
+        completion_id: completion.completion_id, immutable_ref: completion.immutable_ref,
+        state: completion.state, result_commit_ref: completion.git.result_ref,
+      };
     }));
   }
+
   createReleaseAttempt(request = {}) {
+    return this.#exclusive(() => {
     object(request, 'INVALID_RELEASE_ATTEMPT', 'release request');
+    boundedData(request, 'INVALID_RELEASE_ATTEMPT', 'release request');
     for (const field of ['release_attempt_id', 'environment', 'release_plan_ref', 'rollback_plan_ref']) string(request[field], 'INVALID_RELEASE_ATTEMPT', field);
     strings(request.source_completion_refs, 'INVALID_RELEASE_ATTEMPT', 'source_completion_refs');
     if (this.#releases.has(request.release_attempt_id)) fail('RELEASE_ATTEMPT_EXISTS', 'release_attempt_id already exists');
-    const verifiedCompletions = this.#verifyCompletions(request.source_completion_refs);
-    const scope = releaseScope(request);
-    const attempt = freezeData({ ...request, verified_completions: verifiedCompletions, scope, scope_hash: sha256(scope), state: 'created' });
-    this.#releases.set(attempt.release_attempt_id, attempt);
-    this.#record('release_attempt_created', { attempt });
-    return attempt;
+    const verified_completions = this.#verifyCompletions(request.source_completion_refs);
+    const scope = releaseScope(request, this.#authorityContext);
+    const release = freezeData({ ...request, verified_completions, scope, scope_hash: sha256(scope), state: 'created' });
+    this.#record('release_attempt_created', { release });
+    return release;
+    });
+  }
+
+  #rejectRelease(attempt, error) {
+    const release = freezeData({ ...attempt, state: 'rejected', rejection_code: error.code ?? 'RELEASE_PREFLIGHT_FAILED' });
+    this.#record('release_rejected', { release, code: release.rejection_code });
   }
+
   executeRelease({ release_attempt_id, authorization: approval, smoke: smokeInput, adapter } = {}) {
+    return this.#exclusive(() => {
     string(release_attempt_id, 'INVALID_RELEASE_ATTEMPT', 'release_attempt_id');
     const attempt = this.#releases.get(release_attempt_id);
     if (!attempt) fail('RELEASE_ATTEMPT_NOT_FOUND', 'release attempt does not exist');
+    if (['pending_external', 'sent_unconfirmed'].includes(attempt.state)) fail('RELEASE_RECONCILIATION_REQUIRED', 'release result must be reconciled before another send');
     if (attempt.state !== 'created') fail('RELEASE_ATTEMPT_TERMINAL', 'release attempt is no longer executable');
+    let humanAuthorization;
+    let smokeEvidence;
+    let capability;
     try {
-      const humanAuthorization = authorization(approval, attempt.scope_hash);
-      const smokeEvidence = smoke(smokeInput);
-      const capability = fakeAdapter(adapter);
-      this.#record('release_authorized', { release_attempt_id, authorization: humanAuthorization });
-      this.#record('release_smoke_verified', { release_attempt_id, smoke: smokeEvidence });
-      const receipt = capability.release(freezeData({ attempt, authorization: humanAuthorization, smoke: smokeEvidence }));
-      string(receipt?.receipt_ref, 'INVALID_FAKE_RECEIPT', 'fake release receipt_ref');
-      const released = freezeData({ ...attempt, state: 'released', authorization: humanAuthorization, smoke: smokeEvidence, receipt_ref: receipt.receipt_ref });
-      this.#releases.set(release_attempt_id, released);
-      this.#record('release_completed', { release_attempt_id, receipt_ref: receipt.receipt_ref });
+      humanAuthorization = authorization(
+        approval, attempt.scope_hash, this.#authorizationVerifier,
+        this.#consumedAuthorizationIds, this.#clock,
+      );
+      smokeEvidence = smoke(smokeInput, {
+        attempt, verifier: this.#smokeVerifier, clock: this.#clock,
+        consumedEvidenceIds: this.#consumedSmokeEvidenceIds,
+      });
+      capability = releaseTransport(adapter);
+      if (this.#requireProductionTransport && !capability.production) {
+        fail('FAKE_RELEASE_TRANSPORT_FORBIDDEN', 'project release lanes require an externally certified production transport');
+      }
+      if (capability.production && !this.#statePath) fail('MISSING_RELEASE_STATE_PATH', 'production release requires durable state_path');
+    } catch (error) {
+      this.#rejectRelease(attempt, error);
+      throw error;
+    }
+    const idempotency_key = sha256({ operation: 'release', scope_hash: attempt.scope_hash });
+    if (attempt.idempotency_key && attempt.idempotency_key !== idempotency_key) {
+      fail('RELEASE_IDEMPOTENCY_CONFLICT', 'release retry changed its scope-bound idempotency key');
+    }
+    this.#assertExternalBoundary();
+    const pending = freezeData({ ...attempt, state: 'pending_external', authorization: humanAuthorization, smoke: smokeEvidence, idempotency_key, transport_id: capability.transport_id });
+    this.#record('release_intent_recorded', { release: pending, authorization: humanAuthorization, idempotency_key });
+    this.#assertExternalBoundary();
+    try {
+      const receipt = capability.release(freezeData({ attempt: pending, authorization: humanAuthorization, smoke: smokeEvidence, idempotency_key }));
+      if (capability.production) assertReleaseReceiptTime(receipt, pending, at(this.#clock));
+      const released = freezeData({ ...pending, state: 'released', receipt_ref: receipt.receipt_ref, release_receipt: receipt });
+      this.#record('release_completed', { release: released, receipt, idempotency_key });
       return released;
     } catch (error) {
-      this.#releases.set(release_attempt_id, freezeData({ ...attempt, state: 'rejected', rejection_code: error.code ?? 'RELEASE_EXECUTION_FAILED' }));
-      this.#record('release_rejected', { release_attempt_id, code: error.code ?? 'RELEASE_EXECUTION_FAILED' });
+      const uncertain = freezeData({ ...pending, state: 'sent_unconfirmed', uncertainty_code: error.code ?? 'RELEASE_EXTERNAL_RESULT_UNKNOWN' });
+      this.#record('release_sent_unconfirmed', { release: uncertain, code: uncertain.uncertainty_code, idempotency_key });
+      return fail('RELEASE_RESULT_UNCONFIRMED', 'release may have completed externally and requires reconciliation', { cause_code: uncertain.uncertainty_code, idempotency_key });
+    }
+    });
+  }
+
+  reconcileRelease({ release_attempt_id, adapter } = {}) {
+    return this.#exclusive(() => {
+    string(release_attempt_id, 'INVALID_RELEASE_ATTEMPT', 'release_attempt_id');
+    const attempt = this.#releases.get(release_attempt_id);
+    if (!attempt) fail('RELEASE_ATTEMPT_NOT_FOUND', 'release attempt does not exist');
+    if (!['pending_external', 'sent_unconfirmed'].includes(attempt.state)) fail('RELEASE_RECONCILIATION_NOT_REQUIRED', 'release is not awaiting reconciliation');
+    const capability = releaseTransport(adapter);
+    if (this.#requireProductionTransport && !capability.production) {
+      fail('FAKE_RELEASE_TRANSPORT_FORBIDDEN', 'project release lanes require an externally certified production transport');
+    }
+    if (capability.transport_id !== attempt.transport_id) fail('RELEASE_TRANSPORT_MISMATCH', 'reconciliation must use the original transport');
+    this.#assertExternalBoundary();
+    let lookup;
+    try {
+      lookup = capability.lookup(freezeData({ operation: 'release', idempotency_key: attempt.idempotency_key, attempt }));
+    } catch (error) {
+      this.#record('release_reconciliation_failed', { release: attempt, code: error.code ?? 'RELEASE_LOOKUP_FAILED' });
       throw error;
     }
+    if (lookup.status === 'confirmed') {
+      const receipt = lookup.receipt;
+      object(receipt, 'INVALID_RELEASE_RECEIPT', 'release lookup receipt');
+      string(receipt.receipt_ref, 'INVALID_RELEASE_RECEIPT', 'release lookup receipt_ref');
+      if (capability.production) assertReleaseReceiptTime(receipt, attempt, at(this.#clock));
+      const released = freezeData({ ...attempt, state: 'released', receipt_ref: receipt.receipt_ref, release_receipt: receipt });
+      this.#record('release_reconciled', { release: released, lookup });
+      return released;
+    }
+    if (lookup.status === 'not_found') {
+      const retryable = freezeData({ ...attempt, state: 'created' });
+      this.#record('release_reconciled_not_found', { release: retryable, lookup });
+      return retryable;
+    }
+    if (lookup.status !== 'unknown') fail('INVALID_RELEASE_LOOKUP', 'lookup status must be confirmed, not_found or unknown');
+    this.#record('release_reconciliation_inconclusive', { release: attempt, lookup });
+    return attempt;
+    });
   }
+
   executeRollback({ rollback_attempt_id, release_attempt_id, rollback_plan_ref, authorization: approval, smoke: smokeInput, adapter } = {}) {
+    return this.#exclusive(() => {
     string(rollback_attempt_id, 'INVALID_ROLLBACK_ATTEMPT', 'rollback_attempt_id');
     string(release_attempt_id, 'INVALID_ROLLBACK_ATTEMPT', 'release_attempt_id');
     string(rollback_plan_ref, 'INVALID_ROLLBACK_ATTEMPT', 'rollback_plan_ref');
-    if (this.#rollbacks.has(rollback_attempt_id)) fail('ROLLBACK_ATTEMPT_EXISTS', 'rollback_attempt_id already exists');
+    let attempt = this.#rollbacks.get(rollback_attempt_id);
+    if (attempt) {
+      if (['pending_external', 'sent_unconfirmed'].includes(attempt.state)) fail('ROLLBACK_RECONCILIATION_REQUIRED', 'rollback result must be reconciled before another send');
+      if (attempt.state !== 'created') fail('ROLLBACK_ATTEMPT_EXISTS', 'rollback_attempt_id already exists');
+    }
     const release = this.#releases.get(release_attempt_id);
     if (!release || release.state !== 'released') fail('ROLLBACK_SOURCE_NOT_RELEASED', 'rollback requires a separately recorded released attempt');
-    const scope = rollbackScope({ rollback_attempt_id, release_attempt_id, rollback_plan_ref });
-    const attempt = freezeData({ rollback_attempt_id, release_attempt_id, rollback_plan_ref, scope, scope_hash: sha256(scope), state: 'created' });
-    this.#rollbacks.set(rollback_attempt_id, attempt);
-    this.#record('rollback_attempt_created', { attempt });
+    if (!attempt) {
+      const scope = rollbackScope(
+        { rollback_attempt_id, release_attempt_id, rollback_plan_ref },
+        this.#authorityContext,
+      );
+      attempt = freezeData({ rollback_attempt_id, release_attempt_id, rollback_plan_ref, scope, scope_hash: sha256(scope), state: 'created' });
+      this.#record('rollback_attempt_created', { rollback: attempt });
+    } else if (attempt.release_attempt_id !== release_attempt_id || attempt.rollback_plan_ref !== rollback_plan_ref) {
+      fail('ROLLBACK_ATTEMPT_MISMATCH', 'retry must preserve the reconciled rollback scope');
+    }
+    let humanAuthorization;
+    let smokeEvidence;
+    let capability;
+    try {
+      humanAuthorization = authorization(
+        approval, attempt.scope_hash, this.#authorizationVerifier,
+        this.#consumedAuthorizationIds, this.#clock,
+      );
+      smokeEvidence = smoke(smokeInput, {
+        attempt, release, verifier: this.#smokeVerifier, clock: this.#clock,
+        consumedEvidenceIds: this.#consumedSmokeEvidenceIds,
+      });
+      capability = releaseTransport(adapter);
+      if (this.#requireProductionTransport && !capability.production) {
+        fail('FAKE_RELEASE_TRANSPORT_FORBIDDEN', 'project release lanes require an externally certified production transport');
+      }
+      if (capability.production && !this.#statePath) fail('MISSING_RELEASE_STATE_PATH', 'production rollback requires durable state_path');
+    } catch (error) {
+      const rejected = freezeData({ ...attempt, state: 'rejected', rejection_code: error.code ?? 'ROLLBACK_PREFLIGHT_FAILED' });
+      this.#record('rollback_rejected', { rollback: rejected, code: rejected.rejection_code });
+      throw error;
+    }
+    const idempotency_key = sha256({ operation: 'rollback', scope_hash: attempt.scope_hash });
+    if (attempt.idempotency_key && attempt.idempotency_key !== idempotency_key) {
+      fail('ROLLBACK_IDEMPOTENCY_CONFLICT', 'rollback retry changed its scope-bound idempotency key');
+    }
+    this.#assertExternalBoundary();
+    const pending = freezeData({ ...attempt, state: 'pending_external', authorization: humanAuthorization, smoke: smokeEvidence, idempotency_key, transport_id: capability.transport_id });
+    this.#record('rollback_intent_recorded', { rollback: pending, authorization: humanAuthorization, idempotency_key });
+    this.#assertExternalBoundary();
     try {
-      const humanAuthorization = authorization(approval, attempt.scope_hash);
-      const smokeEvidence = smoke(smokeInput);
-      const capability = fakeAdapter(adapter);
-      this.#record('rollback_authorized', { rollback_attempt_id, authorization: humanAuthorization });
-      this.#record('rollback_smoke_verified', { rollback_attempt_id, smoke: smokeEvidence });
-      const receipt = capability.rollback(freezeData({ attempt, release, authorization: humanAuthorization, smoke: smokeEvidence }));
-      string(receipt?.receipt_ref, 'INVALID_FAKE_RECEIPT', 'fake rollback receipt_ref');
-      const rolledBack = freezeData({ ...attempt, state: 'rolled_back', authorization: humanAuthorization, smoke: smokeEvidence, receipt_ref: receipt.receipt_ref });
-      this.#rollbacks.set(rollback_attempt_id, rolledBack);
-      this.#record('rollback_completed', { rollback_attempt_id, receipt_ref: receipt.receipt_ref });
+      const receipt = capability.rollback(freezeData({ attempt: pending, release, authorization: humanAuthorization, smoke: smokeEvidence, idempotency_key }));
+      if (capability.production) assertReleaseReceiptTime(receipt, pending, at(this.#clock));
+      const rolledBack = freezeData({ ...pending, state: 'rolled_back', receipt_ref: receipt.receipt_ref, release_receipt: receipt });
+      this.#record('rollback_completed', { rollback: rolledBack, receipt, idempotency_key });
       return rolledBack;
     } catch (error) {
-      this.#rollbacks.set(rollback_attempt_id, freezeData({ ...attempt, state: 'rejected', rejection_code: error.code ?? 'ROLLBACK_EXECUTION_FAILED' }));
-      this.#record('rollback_rejected', { rollback_attempt_id, code: error.code ?? 'ROLLBACK_EXECUTION_FAILED' });
+      const uncertain = freezeData({ ...pending, state: 'sent_unconfirmed', uncertainty_code: error.code ?? 'ROLLBACK_EXTERNAL_RESULT_UNKNOWN' });
+      this.#record('rollback_sent_unconfirmed', { rollback: uncertain, code: uncertain.uncertainty_code, idempotency_key });
+      return fail('ROLLBACK_RESULT_UNCONFIRMED', 'rollback may have completed externally and requires reconciliation', { cause_code: uncertain.uncertainty_code, idempotency_key });
+    }
+    });
+  }
+
+  reconcileRollback({ rollback_attempt_id, adapter } = {}) {
+    return this.#exclusive(() => {
+    string(rollback_attempt_id, 'INVALID_ROLLBACK_ATTEMPT', 'rollback_attempt_id');
+    const attempt = this.#rollbacks.get(rollback_attempt_id);
+    if (!attempt) fail('ROLLBACK_ATTEMPT_NOT_FOUND', 'rollback attempt does not exist');
+    if (!['pending_external', 'sent_unconfirmed'].includes(attempt.state)) fail('ROLLBACK_RECONCILIATION_NOT_REQUIRED', 'rollback is not awaiting reconciliation');
+    const release = this.#releases.get(attempt.release_attempt_id);
+    if (!release || release.state !== 'released') fail('ROLLBACK_SOURCE_NOT_RELEASED', 'rollback reconciliation requires its released source');
+    const capability = releaseTransport(adapter);
+    if (this.#requireProductionTransport && !capability.production) {
+      fail('FAKE_RELEASE_TRANSPORT_FORBIDDEN', 'project release lanes require an externally certified production transport');
+    }
+    if (capability.transport_id !== attempt.transport_id) fail('RELEASE_TRANSPORT_MISMATCH', 'reconciliation must use the original transport');
+    this.#assertExternalBoundary();
+    let lookup;
+    try {
+      lookup = capability.lookup(freezeData({
+        operation: 'rollback', idempotency_key: attempt.idempotency_key, attempt, release,
+      }));
+    } catch (error) {
+      this.#record('rollback_reconciliation_failed', { rollback: attempt, code: error.code ?? 'ROLLBACK_LOOKUP_FAILED' });
       throw error;
     }
+    if (lookup.status === 'confirmed') {
+      const receipt = lookup.receipt;
+      object(receipt, 'INVALID_RELEASE_RECEIPT', 'rollback lookup receipt');
+      string(receipt.receipt_ref, 'INVALID_RELEASE_RECEIPT', 'rollback lookup receipt_ref');
+      if (capability.production) assertReleaseReceiptTime(receipt, attempt, at(this.#clock));
+      const rolledBack = freezeData({ ...attempt, state: 'rolled_back', receipt_ref: receipt.receipt_ref, release_receipt: receipt });
+      this.#record('rollback_reconciled', { rollback: rolledBack, lookup });
+      return rolledBack;
+    }
+    if (lookup.status === 'not_found') {
+      const retryable = freezeData({ ...attempt, state: 'created' });
+      this.#record('rollback_reconciled_not_found', { rollback: retryable, lookup });
+      return retryable;
+    }
+    if (lookup.status !== 'unknown') fail('INVALID_RELEASE_LOOKUP', 'lookup status must be confirmed, not_found or unknown');
+    this.#record('rollback_reconciliation_inconclusive', { rollback: attempt, lookup });
+    return attempt;
+    });
+  }
+}
+
+/** Production transport capability with idempotent status lookup. */
+export class ReleaseTransport {
+  constructor({ transport_id, authority_id, public_key, release, rollback, lookup } = {}) {
+    string(transport_id, 'INVALID_RELEASE_TRANSPORT', 'transport_id');
+    string(authority_id, 'INVALID_RELEASE_TRANSPORT', 'authority_id');
+    let key;
+    try {
+      key = public_key?.type === 'public' ? public_key : createPublicKey(public_key);
+    } catch {
+      fail('INVALID_RELEASE_TRANSPORT', 'public_key must be a valid Ed25519 deployment authority key');
+    }
+    if (key.type !== 'public' || key.asymmetricKeyType !== 'ed25519') {
+      fail('INVALID_RELEASE_TRANSPORT', 'public_key must be a valid Ed25519 deployment authority key');
+    }
+    if (typeof release !== 'function' || typeof rollback !== 'function' || typeof lookup !== 'function') {
+      fail('INVALID_RELEASE_TRANSPORT', 'release, rollback and lookup must be functions');
+    }
+    const verifyReceipt = (operation, input, receipt) => {
+      object(receipt, 'INVALID_RELEASE_RECEIPT', `${operation} receipt`);
+      for (const field of [
+        'receipt_ref', 'deployment_ref', 'issuer_id', 'transport_id', 'operation',
+        'operation_scope_hash', 'environment', 'idempotency_key', 'observed_at', 'signature',
+      ]) string(receipt[field], 'INVALID_RELEASE_RECEIPT', `${operation} receipt.${field}`);
+      const environment = operation === 'release' ? input.attempt.environment : input.release.environment;
+      if (receipt.issuer_id !== authority_id || receipt.transport_id !== transport_id
+        || receipt.operation !== operation || receipt.operation_scope_hash !== input.attempt.scope_hash
+        || receipt.environment !== environment || receipt.idempotency_key !== input.idempotency_key) {
+        fail('RELEASE_RECEIPT_BINDING_MISMATCH', `${operation} receipt is not bound to the exact remote operation`);
+      }
+      if (!RFC3339.test(receipt.observed_at) || Number.isNaN(Date.parse(receipt.observed_at))) {
+        fail('INVALID_RELEASE_RECEIPT', `${operation} receipt.observed_at must be RFC3339`);
+      }
+      boundedData(receipt, 'INVALID_RELEASE_RECEIPT', `${operation} receipt`, 64 * 1024);
+      let valid;
+      try {
+        valid = verifySignature(
+          null,
+          Buffer.from(JSON.stringify(signedReleaseReceiptPayload(receipt))),
+          key,
+          Buffer.from(receipt.signature, 'base64'),
+        );
+      } catch { valid = false; }
+      if (!valid) fail('INVALID_RELEASE_RECEIPT_SIGNATURE', `${operation} receipt signature is invalid`);
+      return freezeData(receipt, 'INVALID_RELEASE_RECEIPT', `${operation} receipt`);
+    };
+    const invoke = (operation, handler, input) => {
+      const receipt = handler(input);
+      return verifyReceipt(operation, input, receipt);
+    };
+    const invokeLookup = (input) => {
+      const result = lookup(input);
+      object(result, 'INVALID_RELEASE_LOOKUP', 'release lookup');
+      if (!['confirmed', 'not_found', 'unknown'].includes(result.status)) fail('INVALID_RELEASE_LOOKUP', 'lookup status must be confirmed, not_found or unknown');
+      if (result.status !== 'confirmed') return freezeData(result, 'INVALID_RELEASE_LOOKUP', 'release lookup');
+      return freezeData({ status: 'confirmed', receipt: verifyReceipt(input.operation, input, result.receipt) }, 'INVALID_RELEASE_LOOKUP', 'release lookup');
+    };
+    RELEASE_TRANSPORT_CAPABILITIES.set(this, Object.freeze({
+      production: true, transport_id,
+      release: (input) => invoke('release', release, input),
+      rollback: (input) => invoke('rollback', rollback, input),
+      lookup: invokeLookup,
+    }));
+    Object.freeze(this);
   }
 }
 
 export class FakeReleaseTransport {
   #attempts = [];
+  #receipts = new Map();
   constructor() {
+    const transport_id = 'transport://fake/local';
+    const execute = (operation, input) => {
+      const id = operation === 'release' ? input.attempt.release_attempt_id : input.attempt.rollback_attempt_id;
+      const receipt_ref = `fake://${operation}/${id}`;
+      this.#attempts.push(freezeData({ operation, idempotency_key: input.idempotency_key, [`${operation}_attempt_id`]: id }));
+      this.#receipts.set(input.idempotency_key, receipt_ref);
+      return freezeData({ receipt_ref, transport_id });
+    };
     FAKE_TRANSPORT_CAPABILITIES.set(this, Object.freeze({
-      release: (input) => { this.#attempts.push(freezeData({ operation: 'release', release_attempt_id: input.attempt.release_attempt_id })); return freezeData({ receipt_ref: `fake://release/${input.attempt.release_attempt_id}` }); },
-      rollback: (input) => { this.#attempts.push(freezeData({ operation: 'rollback', rollback_attempt_id: input.attempt.rollback_attempt_id })); return freezeData({ receipt_ref: `fake://rollback/${input.attempt.rollback_attempt_id}` }); },
+      production: false, transport_id,
+      release: (input) => execute('release', input),
+      rollback: (input) => execute('rollback', input),
+      lookup: ({ idempotency_key }) => {
+        const receipt_ref = this.#receipts.get(idempotency_key);
+        return freezeData(receipt_ref ? { status: 'confirmed', receipt_ref } : { status: 'not_found' });
+      },
     }));
   }
   get attempts() { return freezeData([...this.#attempts]); }