codex-overleaf-link 2.4.1 → 2.5.1

package/native-host/src/updateManager.js

@@ -4,6 +4,7 @@ const crypto = require('node:crypto');
 const fs = require('node:fs');
 const path = require('node:path');
 const {
+  BOOTSTRAP_PROTOCOL,
   compareSemver,
   isNewerStableVersion,
   parseSemver,
@@ -12,6 +13,9 @@ const {
 } = require('./updateTrust');
 const { extractVerifiedUpdateBundle } = require('./updateArchive');
 const { requestRelease } = require('./releaseTransport');
+const updateNetwork = require('./updateNetworkControl');
+const { readManagedRuntimeEvidence, sameRuntimeEvidence } = require('./managedRuntimeEvidence');
+const BootstrapUpdate = require('./bootstrapUpdate');
 const RUNNING_VERSION = require('../../package.json').version;
 
 const GITHUB_LATEST_URL = 'https://github.com/Ghqqqq/codex-overleaf-link/releases/latest';
@@ -20,6 +24,7 @@ const EXTENSION_MARKER = '.codex-overleaf-managed-extension.json';
 const NATIVE_MARKER = '.codex-overleaf-managed-native.json';
 const JOURNAL_FILE = 'transaction.json';
 const CANDIDATE_FILE = 'candidate.json';
+const MANUAL_CANDIDATE_FILE = 'manual-candidate.json';
 const COOLDOWN_FILE = 'cooldowns.json';
 const AUTHORIZATION_FILE = 'authorization.json';
 const MUTATION_LOCK_FILE = 'mutation.lock';
@@ -27,9 +32,12 @@ const AUTHORIZATION_TTL_MS = 2 * 60 * 60 * 1000;
 const MUTATION_LOCK_WAIT_MS = 10 * 1000;
 const MUTATION_LOCK_STALE_MS = 15 * 60 * 1000;
 const ACTIVATION_DELAY_MS = 125;
+const APPLYING_TRANSACTION_STATES = new Set(['activation_pending', 'applying', 'awaiting_health',
+  ...BootstrapUpdate.BOOTSTRAP_STATES]);
 const CONSENT_MIGRATION_TARGET_VERSION = '1.9.4';
 const UPDATE_METHODS = new Set([
   'update.status',
+  'update.bootstrap',
   'update.check',
   'update.authorize',
   'update.stage',
@@ -38,7 +46,8 @@ const UPDATE_METHODS = new Set([
   'update.activate',
   'update.confirm',
   'update.rollback',
-  'update.revoke'
+  'update.revoke',
+  'update.cancel'
 ]);
 const LAYOUT_GATED_METHODS = new Set([
   'update.check',
@@ -64,7 +73,7 @@ async function handleUpdateRequest(request, options = {}) {
     return errorResponse(request?.id, 'unknown_update_method', 'Unknown managed update method.');
   }
   try {
-    const context = getManagedContext(options);
+    const context = { ...getManagedContext(options), operationId: request.params?.operationId || '' };
     if (!context.managed) {
       throw updateError('update_not_managed', 'Run install-managed once to enable coordinated automatic updates.');
     }
@@ -73,13 +82,22 @@ async function handleUpdateRequest(request, options = {}) {
     }
     switch (request.method) {
       case 'update.status':
-        return okResponse(request.id, await withUpdateMutex(context, () => recoverAndReadStatus(context)));
+        return okResponse(request.id, readStatusWithoutWaiting(context, request.params || {}));
+      case 'update.bootstrap':
+        return okResponse(request.id, await withUpdateMutex(context, () => {
+          const gate = getApplyGate(options);
+          if (!gate.idle) throw updateError('update_native_busy', 'Native host is still processing a Codex task.');
+          return BootstrapUpdate.advanceBootstrapMigration(context, readJournal(context),
+            request.params || {}, bootstrapDependencies(context), options.bootstrapMigration || {});
+        }));
       case 'update.check':
-        return okResponse(request.id, await withUpdateMutex(context, () => checkForUpdate(context, request.params || {}, options)));
+        return okResponse(request.id, await runNetworkUpdate(context, request, options,
+          networkOptions => checkForUpdate(context, request.params || {}, networkOptions)));
       case 'update.authorize':
         return okResponse(request.id, await withUpdateMutex(context, () => authorizeUpdate(context, request.params || {})));
       case 'update.stage':
-        return okResponse(request.id, await withUpdateMutex(context, () => stageCandidate(context, options)));
+        return okResponse(request.id, await runNetworkUpdate(context, request, options,
+          networkOptions => stageCandidate(context, networkOptions)));
       case 'update.canApply':
         return okResponse(request.id, getApplyGate(options));
       case 'update.apply':
@@ -90,18 +108,53 @@ async function handleUpdateRequest(request, options = {}) {
         return okResponse(request.id, await withUpdateMutex(context, () => confirmUpdate(context, request.params || {})));
       case 'update.rollback':
         return okResponse(request.id, await withUpdateMutex(context, () => rollbackUpdate(context, request.params || {})));
-      case 'update.revoke':
-        return okResponse(request.id, await withUpdateMutex(context, () => revokeUpdate(context, request.params || {})));
+      case 'update.cancel':
+        return okResponse(request.id, await cancelNetworkUpdate(context, request.params || {}));
+      case 'update.revoke': {
+        const authorization = readAuthorization(context);
+        const params = request.params || {};
+        if (authorization?.id === params.authorizationId && authorization.targetVersion === params.targetVersion) {
+          const operationId = params.operationId || updateNetwork.readLock(context)?.operationId;
+          if (operationId) await cancelNetworkUpdate(context, { ...params, operationId });
+        }
+        return okResponse(request.id, await withUpdateMutex({ ...context, operationId: '' },
+          () => revokeUpdate(context, params)));
+      }
       default:
         throw updateError('unknown_update_method', 'Unknown managed update method.');
     }
   } catch (error) {
-    return errorResponse(request.id, safeErrorCode(error), safeErrorMessage(error));
+    const code = safeErrorCode(error);
+    return errorResponse(request.id, request.method === 'update.bootstrap' && code === 'update_internal_error'
+      ? 'update_bootstrap_failed' : code, safeErrorMessage(error));
+  }
+}
+
+async function runNetworkUpdate(context, request, options, action) {
+  const operationId = context.operationId || (isUuid(request.id) ? request.id : crypto.randomUUID());
+  const owned = { ...context, operationId };
+  return updateNetwork.run(owned, operationId, signal => withUpdateMutex(owned, () => {
+    signal.throwIfAborted();
+    return action({ ...options, network: { ...options.network, signal } });
+  }), options.network?.signal);
+}
+
+async function cancelNetworkUpdate(context, params) {
+  const journal = readJournal(context);
+  if (journal && (APPLYING_TRANSACTION_STATES.has(journal.state) || journal.sourceActivationPending)) {
+    throw updateError('update_revoke_too_late', 'The update is already being installed.');
   }
+  return updateNetwork.cancel(context, params.operationId);
 }
 
 function withUpdateMutex(context, action) {
-  const guardedAction = () => withUpdateFileLock(context, action);
+  const guardedAction = () => {
+    updateNetwork.assertActive(context, context.operationId);
+    return withUpdateFileLock(context, () => {
+      updateNetwork.assertActive(context, context.operationId);
+      return action();
+    });
+  };
   const result = updateMutationTail.then(guardedAction, guardedAction);
   updateMutationTail = result.catch(() => {});
   return result;
@@ -127,6 +180,7 @@ async function acquireUpdateFileLock(context) {
         fs.writeFileSync(descriptor, JSON.stringify({
           token,
           pid: process.pid,
+          operationId: context.operationId || '',
           createdAt: Date.now(),
           expiresAt: Date.now() + MUTATION_LOCK_STALE_MS
         }) + '\n');
@@ -145,9 +199,16 @@ async function acquireUpdateFileLock(context) {
 
 function removeStaleUpdateFileLock(lockPath) {
   const owner = readJsonSafe(lockPath, null);
-  const expired = !owner || Number(owner.expiresAt || 0) <= Date.now();
-  const abandoned = Number.isInteger(Number(owner?.pid)) && !isProcessAlive(Number(owner.pid));
-  if (!expired && !abandoned) return false;
+  const pid = Number(owner?.pid);
+  if (Number.isInteger(pid) && pid > 0) {
+    // Expiry is not exit evidence. A slow filesystem must not let another
+    // process steal a live install/apply lock.
+    if (isProcessAlive(pid)) return false;
+  } else {
+    // The creator may be between exclusive open and writing its owner record.
+    try { if (Date.now() - fs.statSync(lockPath).mtimeMs < MUTATION_LOCK_STALE_MS) return false; }
+    catch (_error) { return false; }
+  }
   try {
     fs.rmSync(lockPath, { force: true });
     return true;
@@ -172,6 +233,46 @@ function isProcessAlive(pid) {
   }
 }
 
+function bootstrapDependencies(context) {
+  return {
+    runningVersion: RUNNING_VERSION,
+    verifyManifest: verifySignedReleaseManifest,
+    verifyArchive: verifyStagedArchive,
+    writeJournal: value => writeJournal(context, value),
+    assertAuthorization(journal) {
+      const authorization = requireAuthorization(context, journal.targetVersion, ['bound'], { activeVersion: journal.sourceVersion });
+      if (authorization.id !== journal.authorizationId || authorization.transactionId !== journal.id) {
+        throw updateError('update_consent_mismatch', 'Bootstrap update does not match the authorized transaction.');
+      }
+    }
+  };
+}
+
+async function recoverBootstrapTransaction(options, transactionId, token) {
+  const context = getManagedContext(options);
+  if (!context.managed) throw updateError('update_not_managed', 'Managed installation markers are unavailable.');
+  return withUpdateMutex(context, () => {
+    const journal = readJournal(context);
+    if (journal?.id !== transactionId || journal.bootstrapMigration?.watchdogToken !== token) return { state: 'obsolete' };
+    if (journal.sourceActivationPending && journal.state === 'rolled_back') {
+      finishSourceActivation(context, journal);
+      return { state: 'rolled_back', version: journal.sourceVersion };
+    }
+    if (!BootstrapUpdate.bootstrapExpired(journal)) return { state: journal.state };
+    return rollbackUpdate(context, { transactionId, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+  });
+}
+
+function assertBootstrapBusinessAvailable(request, options = {}) {
+  if (isUpdateMethod(request?.method) || ['bridge.ping', 'codex.cancel'].includes(request?.method)) return;
+  const context = getManagedContext(options);
+  if (!context.managed) return;
+  const journal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, journal) || journal?.sourceActivationPending) {
+    throw updateError('update_applying', 'The managed update is still restoring or loading its startup files.');
+  }
+}
+
 function delay(milliseconds) {
   return new Promise(resolve => setTimeout(resolve, milliseconds));
 }
@@ -198,7 +299,8 @@ async function checkForUpdate(context, params = {}, options = {}) {
   });
   if (releaseResponse.status === 304) {
     const candidate = readJsonSafe(path.join(context.updatesRoot, CANDIDATE_FILE), null);
-    if (candidate?.manifestBase64 && candidate?.signatureBase64) {
+    if (candidate?.manifestBase64 && candidate?.signatureBase64
+      && params.etag && candidate.etag === params.etag && candidate.currentVersion === currentVersion) {
       try {
         const manifest = verifySignedReleaseManifest(
           Buffer.from(candidate.manifestBase64, 'base64'),
@@ -218,6 +320,8 @@ async function checkForUpdate(context, params = {}, options = {}) {
         // Invalid cached candidates are treated as cache misses.
       }
     }
+    const manual = readManualCandidate(context, currentVersion, params.etag);
+    if (manual) return { ...manual, etag: params.etag || manual.etag || '', cached: true };
     return { managed: true, available: false, reason: 'not_modified', currentVersion, etag: params.etag || '' };
   }
   if (!releaseResponse.ok) {
@@ -228,6 +332,10 @@ async function checkForUpdate(context, params = {}, options = {}) {
     throw updateError('update_github_response_invalid', 'GitHub latest release did not resolve to a stable semantic-version tag.');
   }
   const latestVersion = releaseTag.slice(1);
+  // A successful latest response replaces the previous discovery result,
+  // including when a release was withdrawn or is now in cooldown.
+  fs.rmSync(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), { force: true });
+  fs.rmSync(path.join(context.updatesRoot, CANDIDATE_FILE), { force: true });
   if (!isNewerStableVersion(latestVersion, currentVersion)) {
     const activeMarker = readJsonSafe(path.join(context.extensionRoot, EXTENSION_MARKER), null);
     const equalVersionPrerelease = compareSemver(latestVersion, currentVersion) === 0
@@ -245,7 +353,8 @@ async function checkForUpdate(context, params = {}, options = {}) {
   }
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
   if (Number(cooldowns[latestVersion]?.until || 0) > Date.now()) {
-    return { managed: true, available: false, reason: 'cooldown', currentVersion, latestVersion, etag: releaseResponse.headers.get('etag') || '' };
+    return { managed: true, available: false, reason: 'cooldown', currentVersion, latestVersion,
+      cooldownUntil: Number(cooldowns[latestVersion].until), etag: releaseResponse.headers.get('etag') || '' };
   }
 
   const manifestBytes = await fetchReleaseAsset(
@@ -258,10 +367,32 @@ async function checkForUpdate(context, params = {}, options = {}) {
     buildReleaseAssetUrl(releaseTag, 'release-manifest.sig'),
     16 * 1024, { ...network, stage: 'release_signature' }
   );
-  const manifest = verifySignedReleaseManifest(manifestBytes, signatureBytes);
+  const manifest = verifySignedReleaseManifest(manifestBytes, signatureBytes, { allowBootstrapMismatch: true });
   if (manifest.version !== latestVersion || manifest.tag !== releaseTag) {
     throw updateError('update_release_manifest_mismatch', 'GitHub release tag does not match the signed update manifest.');
   }
+  if (manifest.bootstrapProtocol !== BOOTSTRAP_PROTOCOL) {
+    // Never staged: only a reinstall can replace the Bootstrap shell. The user
+    // gets the target version and the signed reason instead of a bare error.
+    const manual = {
+      managed: true,
+      available: false,
+      reason: 'manual_install_required',
+      currentVersion,
+      latestVersion,
+      installedBootstrapProtocol: BOOTSTRAP_PROTOCOL,
+      requiredBootstrapProtocol: manifest.bootstrapProtocol,
+      manualInstall: manifest.manualInstall?.reason ? { reason: manifest.manualInstall.reason } : {},
+      etag: releaseResponse.headers.get('etag') || ''
+    };
+    atomicWriteJson(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), {
+      ...manual,
+      checkedAt: new Date().toISOString(),
+      manifestBase64: manifestBytes.toString('base64'),
+      signatureBase64: signatureBytes.toString('base64')
+    });
+    return manual;
+  }
   const candidate = {
     checkedAt: new Date().toISOString(),
     currentVersion,
@@ -275,6 +406,31 @@ async function checkForUpdate(context, params = {}, options = {}) {
   return { managed: true, available: true, currentVersion, latestVersion, etag: candidate.etag };
 }
 
+function readManualCandidate(context, currentVersion, etag) {
+  const manual = readJsonSafe(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), null);
+  if (!etag || manual?.etag !== etag || manual.currentVersion !== currentVersion
+    || !manual.manifestBase64 || !manual.signatureBase64) return null;
+  try {
+    const manifest = verifySignedReleaseManifest(
+      Buffer.from(manual.manifestBase64, 'base64'),
+      Buffer.from(manual.signatureBase64, 'base64'),
+      { allowBootstrapMismatch: true }
+    );
+    if (!isNewerStableVersion(manifest.version, currentVersion)
+      || manifest.bootstrapProtocol === BOOTSTRAP_PROTOCOL) return null;
+    return {
+      managed: true, available: false, reason: 'manual_install_required',
+      currentVersion, latestVersion: manifest.version,
+      installedBootstrapProtocol: BOOTSTRAP_PROTOCOL,
+      requiredBootstrapProtocol: manifest.bootstrapProtocol,
+      manualInstall: manifest.manualInstall?.reason ? { reason: manifest.manualInstall.reason } : {},
+      etag
+    };
+  } catch (_error) {
+    return null;
+  }
+}
+
 function readAuthorizedCandidate(context, currentVersion) {
   const authorization = readAuthorization(context);
   if (!authorization || !['authorized', 'bound'].includes(authorization.state)) return null;
@@ -313,6 +469,10 @@ function buildReleaseAssetUrl(tag, assetName) {
 }
 
 function authorizeUpdate(context, params = {}) {
+  const activeJournal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, activeJournal) || activeJournal?.sourceActivationPending) {
+    throw updateError('update_transaction_in_progress', 'The current Bootstrap update must finish before authorizing another update.');
+  }
   const authorizationId = String(params.authorizationId || '');
   const targetVersion = String(params.targetVersion || '');
   const requestedCurrentVersion = String(params.currentVersion || '');
@@ -360,6 +520,10 @@ function authorizeUpdate(context, params = {}) {
 }
 
 async function stageCandidate(context, options = {}) {
+  const activeJournal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, activeJournal) || activeJournal?.sourceActivationPending) {
+    throw updateError('update_transaction_in_progress', 'The current Bootstrap update must finish before staging another update.');
+  }
   const candidate = readJsonSafe(path.join(context.updatesRoot, CANDIDATE_FILE), null);
   if (!candidate) {
     throw updateError('update_candidate_missing', 'Check for an update before staging it.');
@@ -399,7 +563,7 @@ async function stageCandidate(context, options = {}) {
       );
     }
   }
-  if (existingJournal && ['activation_pending', 'applying', 'awaiting_health'].includes(existingJournal.state)) {
+  if (existingJournal && APPLYING_TRANSACTION_STATES.has(existingJournal.state)) {
     throw updateError('update_transaction_in_progress', 'A managed update transaction is already being applied.');
   }
   if (authorization.state === 'bound') {
@@ -411,7 +575,13 @@ async function stageCandidate(context, options = {}) {
   try {
     const archivePath = path.join(stageRoot, manifest.updateBundle.name);
     const bundleBytes = await fetchReleaseAsset(options.fetch, candidate.bundleUrl, manifest.updateBundle.size + 1,
-      { ...options.network, totalTimeoutMs: 90000, timeoutMs: 30000, stage: 'update_bundle' });
+      { ...options.network, totalTimeoutMs: 300000, timeoutMs: 30000,
+        idleTimeoutMs: 30000, stage: 'update_bundle' });
+    options.network?.signal?.throwIfAborted();
+    const currentAuthorization = requireAuthorization(context, manifest.version, ['authorized', 'bound']);
+    if (currentAuthorization.id !== authorization.id) {
+      throw updateError('update_consent_mismatch', 'The update authorization changed while downloading.');
+    }
     if (bundleBytes.length !== manifest.updateBundle.size) {
       throw updateError('update_bundle_size_mismatch', 'Downloaded update bundle size does not match the signed manifest.');
     }
@@ -459,6 +629,7 @@ function getApplyGate(options = {}) {
   const blockers = [];
   if (Number(state.projectLocks || 0) > 0) blockers.push('native_project_locked');
   if (Number(state.runControllers || 0) > 0) blockers.push('native_run_active');
+  if (Number(state.processStopBarriers || 0) > 0) blockers.push('native_process_stop_unconfirmed');
   return { idle: blockers.length === 0, blockers, workState: state };
 }
 
@@ -503,7 +674,8 @@ function scheduleStagedActivation(context, params = {}, options = {}) {
 
 function recordScheduledActivationFailure(context, pending, error) {
   const current = readJournal(context);
-  if (!current || current.id !== pending.id || ['awaiting_health', 'rolled_back'].includes(current.state)) return;
+  if (!current || current.id !== pending.id || ['awaiting_health', 'rolled_back', 'committed',
+    ...BootstrapUpdate.BOOTSTRAP_STATES].includes(current.state)) return;
   writeJournal(context, {
     ...current,
     state: 'rolled_back',
@@ -613,6 +785,7 @@ function confirmUpdate(context, params = {}) {
   if (params.transactionId !== journal.id || params.extensionVersion !== journal.targetVersion || params.nativeVersion !== journal.targetVersion) {
     throw updateError('update_health_version_mismatch', 'Extension and native host did not confirm the same target version.');
   }
+  BootstrapUpdate.assertBootstrapConfirmation(context, journal, params);
   if (!isLegacyInboundConsentMigration(journal)) {
     const authorization = requireAuthorization(context, journal.targetVersion, ['bound'], {
       activeVersion: journal.sourceVersion
@@ -625,9 +798,15 @@ function confirmUpdate(context, params = {}) {
   if (readVersionPointer(context.nativeRoot, 'active-version') !== journal.targetVersion || manifest?.version !== journal.targetVersion) {
     throw updateError('update_health_version_mismatch', 'Managed files do not match the confirmed target version.');
   }
+  let committedEvidence;
+  try { committedEvidence = readManagedRuntimeEvidence(context, journal.targetVersion); }
+  catch (cause) {
+    throw updateError('update_health_failed', 'The installed runtime files did not pass the update health check.', { cause });
+  }
   writeJournal(context, {
     ...journal,
     state: 'committed',
+    committedEvidence,
     confirmedAt: new Date().toISOString(),
     updatedAt: new Date().toISOString()
   });
@@ -639,29 +818,53 @@ function confirmUpdate(context, params = {}) {
 }
 
 function rollbackUpdate(context, params = {}) {
-  const journal = readJournal(context);
-  if (!journal || !['applying', 'awaiting_health', 'committed'].includes(journal.state)) {
+  let journal = readJournal(context);
+  if (params.transactionId && journal?.id !== params.transactionId) {
+    throw updateError('update_transaction_mismatch', 'Rollback transaction identity changed.');
+  }
+  if (params.expectedState && journal?.state !== params.expectedState) {
+    throw updateError('update_transaction_state_changed', 'The update state changed before rollback.');
+  }
+  journal = BootstrapUpdate.bindBootstrapMigration(context, journal, bootstrapDependencies(context));
+  if (!journal || !['applying', 'awaiting_health', 'committed', 'bootstrap_pending', 'bootstrap_rolling_back'].includes(journal.state)) {
     throw updateError('update_rollback_unavailable', 'No applied update is available for rollback.');
   }
-  rollbackFiles(context, journal);
+  if (journal.bootstrapMigration && !params.transactionId && journal.bootstrapMigration.phase !== 'pending') {
+    throw updateError('update_transaction_mismatch', 'Bootstrap rollback must identify its update transaction.');
+  }
+  const migration = Boolean(journal.bootstrapMigration);
+  if (migration) writeJournal(context, { ...journal, state: 'bootstrap_rolling_back' });
+  const rollbackEvidence = rollbackFiles(context, journal, { deferSourceActivation: migration });
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
   cooldowns[journal.targetVersion] = {
     until: Date.now() + 24 * 60 * 60 * 1000,
     reasonCode: normalizeReasonCode(params.reasonCode)
   };
   atomicWriteJson(path.join(context.updatesRoot, COOLDOWN_FILE), cooldowns);
-  writeJournal(context, {
+  const restoredJournal = {
     ...journal,
     state: 'rolled_back',
     reasonCode: normalizeReasonCode(params.reasonCode),
     rolledBackAt: new Date().toISOString(),
     updatedAt: new Date().toISOString(),
-    previousManifest: undefined
-  });
+    previousManifest: undefined,
+    rollbackEvidence,
+    ...(migration ? { bootstrapMigration: { ...journal.bootstrapMigration, phase: 'restored',
+      sourceUnchanged: rollbackEvidence.bootstrapSourceUnchanged === true },
+      sourceActivationPending: true } : {})
+  };
+  writeJournal(context, restoredJournal);
+  // The old launcher must not select a source process that cannot understand
+  // our recovery record until every file and the durable terminal record exist.
+  if (migration) {
+    settleAuthorization(context, journal.authorizationId, 'revoked');
+    atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
+    writeJournal(context, { ...restoredJournal, sourceActivationPending: false });
+  }
   settleAuthorization(context, journal.authorizationId, 'revoked');
   cleanupStage(journal.stageRoot);
   cleanupOrphanStageRoots(context.updatesRoot);
-  return { version: journal.sourceVersion, state: 'rolled_back' };
+  return { transactionId: journal.id, version: journal.sourceVersion, state: 'rolled_back', restoredPair: rollbackEvidence };
 }
 
 function revokeUpdate(context, params = {}) {
@@ -673,7 +876,7 @@ function revokeUpdate(context, params = {}) {
   }
   const journal = readJournal(context);
   if (journal?.targetVersion === targetVersion &&
-      ['activation_pending', 'applying', 'awaiting_health', 'committed'].includes(journal.state)) {
+      (APPLYING_TRANSACTION_STATES.has(journal.state) || journal.state === 'committed' || journal.sourceActivationPending)) {
     throw updateError('update_revoke_too_late', 'The update is already being applied.');
   }
   const authorization = readAuthorization(context);
@@ -702,9 +905,15 @@ function revokeUpdate(context, params = {}) {
   return { state: 'revoked', targetVersion };
 }
 
-function rollbackFiles(context, journal) {
+function rollbackFiles(context, journal, options = {}) {
   const runtime = path.join(context.extensionRoot, 'runtime');
   const previousRuntime = path.join(context.extensionRoot, 'slots', 'previous', 'runtime');
+  // An early interrupted apply may still have the source in the current slot.
+  // A missing previous slot is recoverable only when these actual bytes match
+  // the source pair; the source manifest and markers alone are insufficient.
+  const source = readManagedRuntimeEvidence(context, journal.sourceVersion,
+    fs.existsSync(previousRuntime) ? previousRuntime : runtime);
+  if (journal.bootstrapMigration) BootstrapUpdate.restoreBootstrap(context, journal);
   if (fs.existsSync(previousRuntime)) {
     fs.rmSync(runtime, { recursive: true, force: true });
     fs.renameSync(previousRuntime, runtime);
@@ -713,7 +922,7 @@ function rollbackFiles(context, journal) {
   if (journal.previousManifest) {
     atomicWriteText(path.join(context.extensionRoot, 'manifest.json'), journal.previousManifest);
   }
-  if (parseSemver(journal.sourceVersion)) {
+  if (parseSemver(journal.sourceVersion) && !options.deferSourceActivation) {
     atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
   }
   const sourcePrevious = parseSemver(journal.sourcePreviousVersion) ? journal.sourcePreviousVersion : '';
@@ -725,6 +934,18 @@ function rollbackFiles(context, journal) {
   if (parseSemver(journal.sourceVersion)) {
     syncManagedMarkerVersions(context, journal.sourceVersion);
   }
+  const restored = readManagedRuntimeEvidence(context, journal.sourceVersion);
+  if (!sameRuntimeEvidence(source, restored)) {
+    throw updateError('update_rollback_unconfirmed', 'The source runtime readback did not match the restored files.');
+  }
+  if (journal.bootstrapMigration) {
+    const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+    if (bootstrap) {
+      restored.bootstrapSha256 = bootstrap.digest;
+      if (bootstrap.unmodified) restored.bootstrapSourceUnchanged = true;
+    }
+  }
+  return restored;
 }
 
 function syncManagedMarkerVersions(context, version) {
@@ -763,8 +984,11 @@ function cleanupOrphanStageRoots(updatesRoot, retainedRoots = []) {
   }
 }
 
-function recoverAndReadStatus(context) {
+function recoverAndReadStatus(context, params = {}) {
   let journal = readJournal(context);
+  if (journal?.sourceActivationPending && journal.state === 'rolled_back') {
+    journal = finishSourceActivation(context, journal);
+  }
   const alignedVersion = readAlignedManagedVersion(context);
   journal = supersedeObsoleteJournal(context, journal, alignedVersion);
   if (journal?.state === 'activation_pending') {
@@ -772,28 +996,145 @@ function recoverAndReadStatus(context) {
     writeJournal(context, journal);
   }
   if (journal?.state === 'applying') {
-    rollbackFiles(context, journal);
-    journal = { ...journal, state: 'rolled_back', reasonCode: 'update_interrupted', updatedAt: new Date().toISOString() };
+    const rollbackEvidence = rollbackFiles(context, journal);
+    journal = { ...journal, rollbackEvidence, state: 'rolled_back', reasonCode: 'update_interrupted', updatedAt: new Date().toISOString() };
     writeJournal(context, journal);
     settleAuthorization(context, journal.authorizationId, 'revoked');
   }
+  journal = BootstrapUpdate.bindBootstrapMigration(context, journal, bootstrapDependencies(context));
+  if (BootstrapUpdate.bootstrapExpired(journal, { recoveryRequested: params.bootstrapRecovery === true, context })) {
+    rollbackUpdate(context, { transactionId: journal.id, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+    journal = readJournal(context);
+  }
   if (journal?.state === 'rolled_back' || journal?.state === 'superseded') {
+    if (journal.state === 'superseded') cleanupStage(journal.stageRoot);
     pruneNativeVersions(context.nativeRoot, new Set([
       readVersionPointer(context.nativeRoot, 'active-version'),
       readVersionPointer(context.nativeRoot, 'previous-version')
     ]));
   }
+  if (journal?.state === 'committed' && journal.committedEvidence && alignedVersion === journal.targetVersion) {
+    const observed = readManagedRuntimeEvidence(context, journal.targetVersion);
+    if (sameRuntimeEvidence(journal.committedEvidence, observed)) {
+      if (journal.bootstrapMigration) BootstrapUpdate.assertBootstrapConfirmation(context, journal,
+        { bootstrapRevision: journal.bootstrapMigration.targetRevision });
+      const authorization = readAuthorization(context);
+      if (['bound', 'consumed'].includes(authorization?.state) && authorization.id === journal.authorizationId
+        && authorization.transactionId === journal.id && authorization.sourceVersion === journal.sourceVersion
+        && authorization.targetVersion === journal.targetVersion) {
+        settleAuthorization(context, journal.authorizationId, 'consumed');
+      }
+      cleanupStage(journal.stageRoot);
+    }
+  }
+  return currentStatus(context, journal);
+}
+
+function finishSourceActivation(context, journal) {
+  const actual = readManagedRuntimeEvidence(context, journal.sourceVersion);
+  if (!sameRuntimeEvidence(actual, journal.rollbackEvidence)) {
+    throw updateError('update_rollback_unconfirmed', 'The recovered source files changed before activation.');
+  }
+  BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+  settleAuthorization(context, journal.authorizationId, 'revoked');
+  atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
+  const finished = { ...journal, sourceActivationPending: false };
+  writeJournal(context, finished);
+  cleanupStage(journal.stageRoot);
+  return finished;
+}
+
+// Called by the full installer while holding the same mutation lock, only
+// after both runtime trees and browser registration have succeeded.
+function settleReinstalledUpdate(context, version, expected) {
+  if (!expected?.id || !parseSemver(expected.sourceVersion) || !parseSemver(expected.targetVersion)
+    || compareSemver(version, expected.targetVersion) < 0
+    || compareSemver(version, expected.sourceVersion) <= 0) return;
+  const journal = readJournal(context);
+  if (!journal || ['id', 'state', 'sourceVersion', 'targetVersion'].some(key => journal[key] !== expected[key])) {
+    throw updateError('update_transaction_mismatch', 'The update transaction changed during full installation.');
+  }
+  if (assertManagedLayout(context) !== version) {
+    throw updateError('update_managed_layout_invalid', 'Full installation did not produce the requested pair.');
+  }
+  const reinstalledPair = readManagedRuntimeEvidence(context, version);
+  const timestamp = new Date().toISOString();
+  writeJournal(context, {
+    ...journal, state: 'superseded', supersededFromState: journal.state,
+    supersededByVersion: version, supersededAt: timestamp,
+    updatedAt: timestamp, reasonCode: 'update_reinstalled', reinstalledPair
+  });
+  const authorization = readAuthorization(context);
+  if (authorization?.state === 'bound' && authorization.id === journal.authorizationId
+    && authorization.transactionId === journal.id && authorization.sourceVersion === journal.sourceVersion
+    && authorization.targetVersion === journal.targetVersion) {
+    settleAuthorization(context, authorization.id, 'revoked');
+  }
+}
+
+function currentStatus(context, journal = readJournal(context)) {
+  let restoredPair = null;
+  let reinstalledPair = null;
+  if (journal?.state === 'rolled_back') {
+    try {
+      const observed = readManagedRuntimeEvidence(context, journal.sourceVersion);
+      if (!journal.rollbackEvidence || sameRuntimeEvidence(journal.rollbackEvidence, observed)) {
+        if (journal.bootstrapMigration) {
+          const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+          if (bootstrap) observed.bootstrapSha256 = bootstrap.digest;
+          if (journal.rollbackEvidence?.bootstrapSha256 !== observed.bootstrapSha256) throw new Error('Bootstrap restoration changed.');
+        }
+        restoredPair = observed;
+      }
+    } catch (_) { /* Missing or changed bytes cannot confirm a recovered pair. */ }
+  }
+  if (journal?.state === 'superseded' && journal.reasonCode === 'update_reinstalled' && journal.reinstalledPair) {
+    try {
+      const observed = readManagedRuntimeEvidence(context, journal.supersededByVersion);
+      if (sameRuntimeEvidence(journal.reinstalledPair, observed)) reinstalledPair = observed;
+    } catch (_) { /* A reinstall receipt cannot authenticate later changed files. */ }
+  }
   return {
     managed: true,
     activeVersion: readVersionPointer(context.nativeRoot, 'active-version'),
     runtimeVersion: context.env?.CODEX_OVERLEAF_ACTIVE_VERSION || RUNNING_VERSION,
-    installedAligned: Boolean(alignedVersion),
+    installedAligned: Boolean(readAlignedManagedVersion(context)),
     previousVersion: readVersionPointer(context.nativeRoot, 'previous-version'),
-    transaction: journal ? publicTransaction(journal) : null,
-    authorization: publicAuthorization(readAuthorization(context))
+    transaction: journal ? { ...publicTransaction(journal),
+      ...(journal.state === 'awaiting_health' && BootstrapUpdate.migrationHint(context, journal)
+        && journal.bootstrapMigration?.phase !== 'loaded' ? { state: 'bootstrap_pending' } : {}) } : null,
+    authorization: publicAuthorization(readAuthorization(context)),
+    restoredPair,
+    reinstalledPair
   };
 }
 
+function readStatusWithoutWaiting(context, params = {}) {
+  const lockPath = path.join(context.updatesRoot, MUTATION_LOCK_FILE);
+  const token = crypto.randomUUID();
+  let descriptor;
+  try {
+    descriptor = fs.openSync(lockPath, 'wx', 0o600);
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw error;
+    const owner = readJsonSafe(lockPath, null);
+    if (Number.isInteger(owner?.pid) && !isProcessAlive(owner.pid) && removeStaleUpdateFileLock(lockPath)) {
+      return readStatusWithoutWaiting(context, params);
+    }
+    // A live mutation owns recovery; report an atomic-file snapshot without
+    // queueing behind its network transfer or changing its journal.
+    return currentStatus(context);
+  }
+  try {
+    fs.writeFileSync(descriptor, JSON.stringify({ token, pid: process.pid,
+      createdAt: Date.now(), expiresAt: Date.now() + MUTATION_LOCK_STALE_MS }));
+    return recoverAndReadStatus(context, params);
+  } finally {
+    fs.closeSync(descriptor);
+    releaseUpdateFileLock({ lockPath, token });
+  }
+}
+
 function readAlignedManagedVersion(context) {
   try {
     return assertManagedLayout(context);
@@ -803,12 +1144,21 @@ function readAlignedManagedVersion(context) {
 }
 
 function supersedeObsoleteJournal(context, journal, activeVersion) {
-  if (!journal || journal.state === 'superseded' || !parseSemver(activeVersion) ||
+  if (!journal || !parseSemver(activeVersion) ||
       !parseSemver(journal.sourceVersion) || !parseSemver(journal.targetVersion) ||
       compareSemver(activeVersion, journal.sourceVersion) <= 0 ||
       compareSemver(activeVersion, journal.targetVersion) <= 0) {
     return journal;
   }
+  // A previous runtime may already have retired the journal without settling
+  // its bound authorization. Never consume an authorization owned elsewhere.
+  const authorization = readAuthorization(context);
+  if (authorization?.state === 'bound' && journal.authorizationId
+      && authorization.id === journal.authorizationId && authorization.transactionId === journal.id
+      && authorization.sourceVersion === journal.sourceVersion && authorization.targetVersion === journal.targetVersion) {
+    settleAuthorization(context, authorization.id, 'revoked');
+  }
+  if (journal.state === 'superseded') return journal;
   const timestamp = new Date().toISOString();
   const superseded = {
     ...journal,
@@ -886,7 +1236,7 @@ function assertManagedLayout(context) {
 }
 
 function isManagedMarker(marker, kind) {
-  return marker?.managedBy === 'codex-overleaf-link' && marker?.kind === kind && marker?.bootstrapProtocol === 2;
+  return marker?.managedBy === 'codex-overleaf-link' && marker?.kind === kind && marker?.bootstrapProtocol === BOOTSTRAP_PROTOCOL;
 }
 
 function verifyStagedPair(payloadRoot, targetVersion) {
@@ -988,6 +1338,7 @@ function publicTransaction(journal) {
     state: journal.state,
     sourceVersion: journal.sourceVersion,
     targetVersion: journal.targetVersion,
+    ...(journal.bootstrapMigration ? { bootstrapRevision: journal.bootstrapMigration.targetRevision } : {}),
     createdAt: journal.createdAt,
     activationRequestedAt: journal.activationRequestedAt,
     appliedAt: journal.appliedAt,
@@ -1079,10 +1430,22 @@ function atomicWriteJson(target, value) {
 }
 
 function atomicWriteText(target, value) {
-  const temp = target + '.tmp-' + process.pid + '-' + Date.now();
+  const temp = target + '.tmp-' + process.pid + '-' + crypto.randomBytes(6).toString('hex');
   fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(temp, value, { mode: 0o600 });
+  let descriptor = fs.openSync(temp, 'wx', 0o600);
+  try {
+    // Windows requires a writable handle for FlushFileBuffers (Node fsync).
+    fs.writeFileSync(descriptor, value);
+    fs.fsyncSync(descriptor);
+  } finally { if (descriptor !== undefined) fs.closeSync(descriptor); }
   fs.renameSync(temp, target);
+  descriptor = undefined;
+  try {
+    descriptor = fs.openSync(path.dirname(target), 'r');
+    fs.fsyncSync(descriptor);
+  } catch (error) {
+    if (process.platform !== 'win32' || !['EPERM', 'EISDIR', 'EINVAL', 'EBADF', 'EACCES'].includes(error.code)) throw error;
+  } finally { if (descriptor !== undefined) fs.closeSync(descriptor); }
 }
 
 function readJsonSafe(target, fallback) {
@@ -1136,8 +1499,10 @@ function errorResponse(id, code, message) {
 
 module.exports = {
   GITHUB_LATEST_URL,
+  MUTATION_LOCK_STALE_MS,
   applyStagedUpdate,
   assertManagedLayout,
+  assertBootstrapBusinessAvailable,
   authorizeUpdate,
   checkForUpdate,
   cleanupOrphanStageRoots,
@@ -1147,8 +1512,11 @@ module.exports = {
   handleUpdateRequest,
   isUpdateMethod,
   revokeUpdate,
+  removeStaleUpdateFileLock,
+  recoverBootstrapTransaction,
   rollbackUpdate,
   scheduleStagedActivation,
+  settleReinstalledUpdate,
   stageCandidate,
   syncManagedMarkerVersions
 };