codex-overleaf-link 2.5.0 → 2.6.0

package/native-host/src/updateManager.js

@@ -14,6 +14,8 @@ const {
 const { extractVerifiedUpdateBundle } = require('./updateArchive');
 const { requestRelease } = require('./releaseTransport');
 const updateNetwork = require('./updateNetworkControl');
+const { readManagedRuntimeEvidence, sameRuntimeEvidence } = require('./managedRuntimeEvidence');
+const BootstrapUpdate = require('./bootstrapUpdate');
 const RUNNING_VERSION = require('../../package.json').version;
 
 const GITHUB_LATEST_URL = 'https://github.com/Ghqqqq/codex-overleaf-link/releases/latest';
@@ -30,9 +32,17 @@ const AUTHORIZATION_TTL_MS = 2 * 60 * 60 * 1000;
 const MUTATION_LOCK_WAIT_MS = 10 * 1000;
 const MUTATION_LOCK_STALE_MS = 15 * 60 * 1000;
 const ACTIVATION_DELAY_MS = 125;
+const APPLYING_TRANSACTION_STATES = new Set(['activation_pending', 'applying', 'awaiting_health',
+  ...BootstrapUpdate.BOOTSTRAP_STATES]);
 const CONSENT_MIGRATION_TARGET_VERSION = '1.9.4';
+// Pure reads of user-owned stores that do not depend on update files. They stay
+// available while a migration or its recovery is unsettled.
+const READ_ONLY_DURING_UPDATE = new Set(['codex.providers.list']);
+// A user-requested return to the source version of an applied update.
+const USER_ROLLBACK_REASON = 'update_user_rollback';
 const UPDATE_METHODS = new Set([
   'update.status',
+  'update.bootstrap',
   'update.check',
   'update.authorize',
   'update.stage',
@@ -77,7 +87,14 @@ async function handleUpdateRequest(request, options = {}) {
     }
     switch (request.method) {
       case 'update.status':
-        return okResponse(request.id, readStatusWithoutWaiting(context));
+        return okResponse(request.id, readStatusWithoutWaiting(context, request.params || {}));
+      case 'update.bootstrap':
+        return okResponse(request.id, await withUpdateMutex(context, () => {
+          const gate = getApplyGate(options);
+          if (!gate.idle) throw updateError('update_native_busy', 'Native host is still processing a Codex task.');
+          return BootstrapUpdate.advanceBootstrapMigration(context, readJournal(context),
+            request.params || {}, bootstrapDependencies(context), options.bootstrapMigration || {});
+        }));
       case 'update.check':
         return okResponse(request.id, await runNetworkUpdate(context, request, options,
           networkOptions => checkForUpdate(context, request.params || {}, networkOptions)));
@@ -95,7 +112,12 @@ async function handleUpdateRequest(request, options = {}) {
       case 'update.confirm':
         return okResponse(request.id, await withUpdateMutex(context, () => confirmUpdate(context, request.params || {})));
       case 'update.rollback':
-        return okResponse(request.id, await withUpdateMutex(context, () => rollbackUpdate(context, request.params || {})));
+        return okResponse(request.id, await withUpdateMutex(context, () => {
+          if (request.params?.reasonCode === USER_ROLLBACK_REASON && !getApplyGate(options).idle) {
+            throw updateError('update_native_busy', 'Native host is still processing a Codex task.');
+          }
+          return rollbackUpdate(context, request.params || {});
+        }));
       case 'update.cancel':
         return okResponse(request.id, await cancelNetworkUpdate(context, request.params || {}));
       case 'update.revoke': {
@@ -112,7 +134,9 @@ async function handleUpdateRequest(request, options = {}) {
         throw updateError('unknown_update_method', 'Unknown managed update method.');
     }
   } catch (error) {
-    return errorResponse(request.id, safeErrorCode(error), safeErrorMessage(error));
+    const code = safeErrorCode(error);
+    return errorResponse(request.id, request.method === 'update.bootstrap' && code === 'update_internal_error'
+      ? 'update_bootstrap_failed' : code, safeErrorMessage(error));
   }
 }
 
@@ -127,7 +151,7 @@ async function runNetworkUpdate(context, request, options, action) {
 
 async function cancelNetworkUpdate(context, params) {
   const journal = readJournal(context);
-  if (journal && ['activation_pending', 'applying', 'awaiting_health'].includes(journal.state)) {
+  if (journal && (APPLYING_TRANSACTION_STATES.has(journal.state) || journal.sourceActivationPending)) {
     throw updateError('update_revoke_too_late', 'The update is already being installed.');
   }
   return updateNetwork.cancel(context, params.operationId);
@@ -185,9 +209,16 @@ async function acquireUpdateFileLock(context) {
 
 function removeStaleUpdateFileLock(lockPath) {
   const owner = readJsonSafe(lockPath, null);
-  const expired = !owner || Number(owner.expiresAt || 0) <= Date.now();
-  const abandoned = Number.isInteger(Number(owner?.pid)) && !isProcessAlive(Number(owner.pid));
-  if (!expired && !abandoned) return false;
+  const pid = Number(owner?.pid);
+  if (Number.isInteger(pid) && pid > 0) {
+    // Expiry is not exit evidence. A slow filesystem must not let another
+    // process steal a live install/apply lock.
+    if (isProcessAlive(pid)) return false;
+  } else {
+    // The creator may be between exclusive open and writing its owner record.
+    try { if (Date.now() - fs.statSync(lockPath).mtimeMs < MUTATION_LOCK_STALE_MS) return false; }
+    catch (_error) { return false; }
+  }
   try {
     fs.rmSync(lockPath, { force: true });
     return true;
@@ -212,6 +243,47 @@ function isProcessAlive(pid) {
   }
 }
 
+function bootstrapDependencies(context) {
+  return {
+    runningVersion: RUNNING_VERSION,
+    verifyManifest: verifySignedReleaseManifest,
+    verifyArchive: verifyStagedArchive,
+    writeJournal: value => writeJournal(context, value),
+    assertAuthorization(journal) {
+      const authorization = requireAuthorization(context, journal.targetVersion, ['bound'], { activeVersion: journal.sourceVersion });
+      if (authorization.id !== journal.authorizationId || authorization.transactionId !== journal.id) {
+        throw updateError('update_consent_mismatch', 'Bootstrap update does not match the authorized transaction.');
+      }
+    }
+  };
+}
+
+async function recoverBootstrapTransaction(options, transactionId, token) {
+  const context = getManagedContext(options);
+  if (!context.managed) throw updateError('update_not_managed', 'Managed installation markers are unavailable.');
+  return withUpdateMutex(context, () => {
+    const journal = readJournal(context);
+    if (journal?.id !== transactionId || journal.bootstrapMigration?.watchdogToken !== token) return { state: 'obsolete' };
+    if (journal.sourceActivationPending && journal.state === 'rolled_back') {
+      finishSourceActivation(context, journal);
+      return { state: 'rolled_back', version: journal.sourceVersion };
+    }
+    if (!BootstrapUpdate.bootstrapExpired(journal)) return { state: journal.state };
+    return rollbackUpdate(context, { transactionId, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+  });
+}
+
+function assertBootstrapBusinessAvailable(request, options = {}) {
+  if (isUpdateMethod(request?.method) || ['bridge.ping', 'codex.cancel'].includes(request?.method)
+    || READ_ONLY_DURING_UPDATE.has(request?.method)) return;
+  const context = getManagedContext(options);
+  if (!context.managed) return;
+  const journal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, journal) || journal?.sourceActivationPending) {
+    throw updateError('update_applying', 'The managed update is still restoring or loading its startup files.');
+  }
+}
+
 function delay(milliseconds) {
   return new Promise(resolve => setTimeout(resolve, milliseconds));
 }
@@ -238,7 +310,8 @@ async function checkForUpdate(context, params = {}, options = {}) {
   });
   if (releaseResponse.status === 304) {
     const candidate = readJsonSafe(path.join(context.updatesRoot, CANDIDATE_FILE), null);
-    if (candidate?.manifestBase64 && candidate?.signatureBase64) {
+    if (candidate?.manifestBase64 && candidate?.signatureBase64
+      && params.etag && candidate.etag === params.etag && candidate.currentVersion === currentVersion) {
       try {
         const manifest = verifySignedReleaseManifest(
           Buffer.from(candidate.manifestBase64, 'base64'),
@@ -258,7 +331,7 @@ async function checkForUpdate(context, params = {}, options = {}) {
         // Invalid cached candidates are treated as cache misses.
       }
     }
-    const manual = readManualCandidate(context, currentVersion);
+    const manual = readManualCandidate(context, currentVersion, params.etag);
     if (manual) return { ...manual, etag: params.etag || manual.etag || '', cached: true };
     return { managed: true, available: false, reason: 'not_modified', currentVersion, etag: params.etag || '' };
   }
@@ -270,6 +343,10 @@ async function checkForUpdate(context, params = {}, options = {}) {
     throw updateError('update_github_response_invalid', 'GitHub latest release did not resolve to a stable semantic-version tag.');
   }
   const latestVersion = releaseTag.slice(1);
+  // A successful latest response replaces the previous discovery result,
+  // including when a release was withdrawn or is now in cooldown.
+  fs.rmSync(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), { force: true });
+  fs.rmSync(path.join(context.updatesRoot, CANDIDATE_FILE), { force: true });
   if (!isNewerStableVersion(latestVersion, currentVersion)) {
     const activeMarker = readJsonSafe(path.join(context.extensionRoot, EXTENSION_MARKER), null);
     const equalVersionPrerelease = compareSemver(latestVersion, currentVersion) === 0
@@ -286,8 +363,14 @@ async function checkForUpdate(context, params = {}, options = {}) {
     };
   }
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
-  if (Number(cooldowns[latestVersion]?.until || 0) > Date.now()) {
-    return { managed: true, available: false, reason: 'cooldown', currentVersion, latestVersion, etag: releaseResponse.headers.get('etag') || '' };
+  const cooldown = cooldowns[latestVersion];
+  // Read legacy user-rollback cooldowns, allowing explicit checks to bypass
+  // them. New user rollbacks defer browser prompts without a Native cooldown.
+  if (Number(cooldown?.until || 0) > Date.now()
+    && !(cooldown.reasonCode === USER_ROLLBACK_REASON && params.manual === true)) {
+    return { managed: true, available: false, reason: 'cooldown', currentVersion, latestVersion,
+      cooldownUntil: Number(cooldown.until), cooldownReason: cooldown.reasonCode || '',
+      etag: releaseResponse.headers.get('etag') || '' };
   }
 
   const manifestBytes = await fetchReleaseAsset(
@@ -318,7 +401,25 @@ async function checkForUpdate(context, params = {}, options = {}) {
       manualInstall: manifest.manualInstall?.reason ? { reason: manifest.manualInstall.reason } : {},
       etag: releaseResponse.headers.get('etag') || ''
     };
-    atomicWriteJson(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), { ...manual, checkedAt: new Date().toISOString() });
+    atomicWriteJson(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), {
+      ...manual,
+      checkedAt: new Date().toISOString(),
+      manifestBase64: manifestBytes.toString('base64'),
+      signatureBase64: signatureBytes.toString('base64')
+    });
+    return manual;
+  }
+  try {
+    BootstrapUpdate.assertMigrationSource(context, manifest, currentVersion);
+  } catch (error) {
+    if (error.code !== 'update_bootstrap_source_mismatch') throw error;
+    // Never cached as an installable candidate: only a reinstall can replace
+    // startup files this release cannot migrate.
+    const manual = { managed: true, available: false, reason: 'manual_install_required', code: error.code,
+      currentVersion, latestVersion, manualInstall: {}, etag: releaseResponse.headers.get('etag') || '' };
+    atomicWriteJson(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), { ...manual,
+      checkedAt: new Date().toISOString(), manifestBase64: manifestBytes.toString('base64'),
+      signatureBase64: signatureBytes.toString('base64') });
     return manual;
   }
   const candidate = {
@@ -334,13 +435,36 @@ async function checkForUpdate(context, params = {}, options = {}) {
   return { managed: true, available: true, currentVersion, latestVersion, etag: candidate.etag };
 }
 
-function readManualCandidate(context, currentVersion) {
+function readManualCandidate(context, currentVersion, etag) {
   const manual = readJsonSafe(path.join(context.updatesRoot, MANUAL_CANDIDATE_FILE), null);
-  if (manual?.reason !== 'manual_install_required' || !parseSemver(manual.latestVersion)
-    || !isNewerStableVersion(manual.latestVersion, currentVersion)
-    || manual.requiredBootstrapProtocol === BOOTSTRAP_PROTOCOL) return null;
-  const { checkedAt: _checkedAt, ...result } = manual;
-  return { ...result, currentVersion };
+  if (!etag || manual?.etag !== etag || manual.currentVersion !== currentVersion
+    || !manual.manifestBase64 || !manual.signatureBase64) return null;
+  try {
+    const manifest = verifySignedReleaseManifest(
+      Buffer.from(manual.manifestBase64, 'base64'),
+      Buffer.from(manual.signatureBase64, 'base64'),
+      { allowBootstrapMismatch: true }
+    );
+    if (!isNewerStableVersion(manifest.version, currentVersion)) return null;
+    if (manifest.bootstrapProtocol === BOOTSTRAP_PROTOCOL) {
+      // Same protocol: a hint only while the installed startup files still
+      // cannot be migrated by this signed release.
+      try { BootstrapUpdate.assertMigrationSource(context, manifest, currentVersion); return null; }
+      catch (error) { if (error.code !== 'update_bootstrap_source_mismatch') return null; }
+      return { managed: true, available: false, reason: 'manual_install_required', code: 'update_bootstrap_source_mismatch',
+        currentVersion, latestVersion: manifest.version, manualInstall: {}, etag };
+    }
+    return {
+      managed: true, available: false, reason: 'manual_install_required',
+      currentVersion, latestVersion: manifest.version,
+      installedBootstrapProtocol: BOOTSTRAP_PROTOCOL,
+      requiredBootstrapProtocol: manifest.bootstrapProtocol,
+      manualInstall: manifest.manualInstall?.reason ? { reason: manifest.manualInstall.reason } : {},
+      etag
+    };
+  } catch (_error) {
+    return null;
+  }
 }
 
 function readAuthorizedCandidate(context, currentVersion) {
@@ -381,6 +505,10 @@ function buildReleaseAssetUrl(tag, assetName) {
 }
 
 function authorizeUpdate(context, params = {}) {
+  const activeJournal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, activeJournal) || activeJournal?.sourceActivationPending) {
+    throw updateError('update_transaction_in_progress', 'The current Bootstrap update must finish before authorizing another update.');
+  }
   const authorizationId = String(params.authorizationId || '');
   const targetVersion = String(params.targetVersion || '');
   const requestedCurrentVersion = String(params.currentVersion || '');
@@ -402,6 +530,7 @@ function authorizeUpdate(context, params = {}) {
       !isNewerStableVersion(targetVersion, activeVersion)) {
     throw updateError('update_consent_mismatch', 'Update authorization does not match the active signed candidate.');
   }
+  BootstrapUpdate.assertMigrationSource(context, manifest, activeVersion);
   const existing = readAuthorization(context);
   if (existing?.id === authorizationId &&
       existing.targetVersion === targetVersion &&
@@ -428,6 +557,10 @@ function authorizeUpdate(context, params = {}) {
 }
 
 async function stageCandidate(context, options = {}) {
+  const activeJournal = readJournal(context);
+  if (BootstrapUpdate.migrationHint(context, activeJournal) || activeJournal?.sourceActivationPending) {
+    throw updateError('update_transaction_in_progress', 'The current Bootstrap update must finish before staging another update.');
+  }
   const candidate = readJsonSafe(path.join(context.updatesRoot, CANDIDATE_FILE), null);
   if (!candidate) {
     throw updateError('update_candidate_missing', 'Check for an update before staging it.');
@@ -440,6 +573,11 @@ async function stageCandidate(context, options = {}) {
     throw updateError('update_candidate_stale', 'The staged update is no longer newer than the active version.');
   }
   const authorization = requireAuthorization(context, manifest.version, ['authorized', 'bound']);
+  try { BootstrapUpdate.assertMigrationSource(context, manifest, activeVersion); }
+  catch (error) {
+    if (authorization.state === 'authorized') settleAuthorization(context, authorization.id, 'revoked');
+    throw error;
+  }
   const existingJournal = readJournal(context);
   if (existingJournal?.state === 'staged' && existingJournal.targetVersion === manifest.version) {
     if (existingJournal.authorizationId !== authorization.id ||
@@ -467,7 +605,7 @@ async function stageCandidate(context, options = {}) {
       );
     }
   }
-  if (existingJournal && ['activation_pending', 'applying', 'awaiting_health'].includes(existingJournal.state)) {
+  if (existingJournal && APPLYING_TRANSACTION_STATES.has(existingJournal.state)) {
     throw updateError('update_transaction_in_progress', 'A managed update transaction is already being applied.');
   }
   if (authorization.state === 'bound') {
@@ -533,6 +671,7 @@ function getApplyGate(options = {}) {
   const blockers = [];
   if (Number(state.projectLocks || 0) > 0) blockers.push('native_project_locked');
   if (Number(state.runControllers || 0) > 0) blockers.push('native_run_active');
+  if (Number(state.processStopBarriers || 0) > 0) blockers.push('native_process_stop_unconfirmed');
   return { idle: blockers.length === 0, blockers, workState: state };
 }
 
@@ -577,7 +716,8 @@ function scheduleStagedActivation(context, params = {}, options = {}) {
 
 function recordScheduledActivationFailure(context, pending, error) {
   const current = readJournal(context);
-  if (!current || current.id !== pending.id || ['awaiting_health', 'rolled_back'].includes(current.state)) return;
+  if (!current || current.id !== pending.id || ['awaiting_health', 'rolled_back', 'committed',
+    ...BootstrapUpdate.BOOTSTRAP_STATES].includes(current.state)) return;
   writeJournal(context, {
     ...current,
     state: 'rolled_back',
@@ -687,6 +827,7 @@ function confirmUpdate(context, params = {}) {
   if (params.transactionId !== journal.id || params.extensionVersion !== journal.targetVersion || params.nativeVersion !== journal.targetVersion) {
     throw updateError('update_health_version_mismatch', 'Extension and native host did not confirm the same target version.');
   }
+  BootstrapUpdate.assertBootstrapConfirmation(context, journal, params);
   if (!isLegacyInboundConsentMigration(journal)) {
     const authorization = requireAuthorization(context, journal.targetVersion, ['bound'], {
       activeVersion: journal.sourceVersion
@@ -699,9 +840,15 @@ function confirmUpdate(context, params = {}) {
   if (readVersionPointer(context.nativeRoot, 'active-version') !== journal.targetVersion || manifest?.version !== journal.targetVersion) {
     throw updateError('update_health_version_mismatch', 'Managed files do not match the confirmed target version.');
   }
+  let committedEvidence;
+  try { committedEvidence = readManagedRuntimeEvidence(context, journal.targetVersion); }
+  catch (cause) {
+    throw updateError('update_health_failed', 'The installed runtime files did not pass the update health check.', { cause });
+  }
   writeJournal(context, {
     ...journal,
     state: 'committed',
+    committedEvidence,
     confirmedAt: new Date().toISOString(),
     updatedAt: new Date().toISOString()
   });
@@ -713,35 +860,101 @@ function confirmUpdate(context, params = {}) {
 }
 
 function rollbackUpdate(context, params = {}) {
-  const journal = readJournal(context);
+  let journal = readJournal(context);
   if (params.transactionId && journal?.id !== params.transactionId) {
     throw updateError('update_transaction_mismatch', 'Rollback transaction identity changed.');
   }
   if (params.expectedState && journal?.state !== params.expectedState) {
     throw updateError('update_transaction_state_changed', 'The update state changed before rollback.');
   }
-  if (!journal || !['applying', 'awaiting_health', 'committed'].includes(journal.state)) {
+  journal = BootstrapUpdate.bindBootstrapMigration(context, journal, bootstrapDependencies(context));
+  if (!journal || !['applying', 'awaiting_health', 'committed', 'bootstrap_pending', 'bootstrap_rolling_back'].includes(journal.state)) {
     throw updateError('update_rollback_unavailable', 'No applied update is available for rollback.');
   }
-  rollbackFiles(context, journal);
+  if (journal.bootstrapMigration && !params.transactionId && journal.bootstrapMigration.phase !== 'pending') {
+    throw updateError('update_transaction_mismatch', 'Bootstrap rollback must identify its update transaction.');
+  }
+  const userRequested = params.reasonCode === USER_ROLLBACK_REASON;
+  // Check every precondition before writing the rolling-back state, so an
+  // unavailable request never turns a working installation into a recovery.
+  if (userRequested && (!params.transactionId
+    || (journal.state === 'committed' && !userRollbackAvailable(context, journal)))) {
+    throw updateError('update_rollback_unavailable', 'The previous version is no longer available for rollback.');
+  }
+  const migration = Boolean(journal.bootstrapMigration);
+  if (migration) writeJournal(context, { ...journal, state: 'bootstrap_rolling_back' });
+  let rollbackEvidence;
+  try {
+    rollbackEvidence = rollbackFiles(context, journal, { deferSourceActivation: migration });
+  } catch (error) {
+    // The incomplete state remains. The failure record bounds automatic retries
+    // and lets status report the reason; explicit rollback requests still run.
+    const failed = readJournal(context);
+    if (failed?.id === journal.id) {
+      writeJournal(context, { ...failed, updatedAt: new Date().toISOString(), rollbackFailure: {
+        code: safeErrorCode(error), attempts: Number(failed.rollbackFailure?.attempts || 0) + 1,
+        at: new Date().toISOString() } });
+    }
+    throw error;
+  }
   const cooldowns = readJsonSafe(path.join(context.updatesRoot, COOLDOWN_FILE), {});
-  cooldowns[journal.targetVersion] = {
-    until: Date.now() + 24 * 60 * 60 * 1000,
-    reasonCode: normalizeReasonCode(params.reasonCode)
-  };
+  if (userRequested) {
+    // The restored Native may predate manual-check exemptions. Keep its
+    // original check usable; the coordinator snoozes automatic prompts.
+    delete cooldowns[journal.targetVersion];
+  } else {
+    cooldowns[journal.targetVersion] = {
+      until: Date.now() + 24 * 60 * 60 * 1000,
+      reasonCode: normalizeReasonCode(params.reasonCode)
+    };
+  }
   atomicWriteJson(path.join(context.updatesRoot, COOLDOWN_FILE), cooldowns);
-  writeJournal(context, {
+  const restoredJournal = {
     ...journal,
     state: 'rolled_back',
     reasonCode: normalizeReasonCode(params.reasonCode),
     rolledBackAt: new Date().toISOString(),
     updatedAt: new Date().toISOString(),
-    previousManifest: undefined
-  });
+    previousManifest: undefined,
+    rollbackFailure: undefined,
+    rollbackEvidence,
+    ...(migration ? { bootstrapMigration: { ...journal.bootstrapMigration, phase: 'restored',
+      sourceUnchanged: rollbackEvidence.bootstrapSourceUnchanged === true },
+      sourceActivationPending: true } : {})
+  };
+  writeJournal(context, restoredJournal);
+  // The old launcher must not select a source process that cannot understand
+  // our recovery record until every file and the durable terminal record exist.
+  if (migration) {
+    settleAuthorization(context, journal.authorizationId, 'revoked');
+    atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
+    writeJournal(context, { ...restoredJournal, sourceActivationPending: false });
+  }
   settleAuthorization(context, journal.authorizationId, 'revoked');
   cleanupStage(journal.stageRoot);
   cleanupOrphanStageRoots(context.updatesRoot);
-  return { version: journal.sourceVersion, state: 'rolled_back' };
+  return { transactionId: journal.id, version: journal.sourceVersion, state: 'rolled_back', restoredPair: rollbackEvidence };
+}
+
+// A committed update can be returned to its source pair only while every
+// source layer is still on disk: the previous runtime slot, the source Native
+// version, the saved manifest and, for a Bootstrap migration, its backups.
+function userRollbackAvailable(context, journal) {
+  if (journal?.state !== 'committed' || !parseSemver(journal.sourceVersion) || !journal.previousManifest
+    || readVersionPointer(context.nativeRoot, 'active-version') !== journal.targetVersion) return false;
+  if (journal.bootstrapMigration
+    && !fs.existsSync(path.join(context.updatesRoot, 'bootstrap-migrations', journal.id, 'state.json'))) return false;
+  // Status runs often, so this reads only the version identities. rollbackFiles
+  // still verifies both full source trees before and after restoring them.
+  const previousRuntime = path.join(context.extensionRoot, 'slots', 'previous', 'runtime');
+  try {
+    const compatibility = fs.readFileSync(path.join(previousRuntime, 'src', 'shared', 'compatibility.js'), 'utf8');
+    const nativePackage = readJsonSafe(path.join(context.nativeRoot, 'versions', journal.sourceVersion, 'package.json'), null);
+    return compatibility.match(/BUILD_TARGET_VERSION\s*=\s*['"]([^'"]+)['"]/)?.[1] === journal.sourceVersion
+      && nativePackage?.version === journal.sourceVersion;
+  } catch (_) {
+    return false;
+  }
 }
 
 function revokeUpdate(context, params = {}) {
@@ -753,7 +966,7 @@ function revokeUpdate(context, params = {}) {
   }
   const journal = readJournal(context);
   if (journal?.targetVersion === targetVersion &&
-      ['activation_pending', 'applying', 'awaiting_health', 'committed'].includes(journal.state)) {
+      (APPLYING_TRANSACTION_STATES.has(journal.state) || journal.state === 'committed' || journal.sourceActivationPending)) {
     throw updateError('update_revoke_too_late', 'The update is already being applied.');
   }
   const authorization = readAuthorization(context);
@@ -782,9 +995,15 @@ function revokeUpdate(context, params = {}) {
   return { state: 'revoked', targetVersion };
 }
 
-function rollbackFiles(context, journal) {
+function rollbackFiles(context, journal, options = {}) {
   const runtime = path.join(context.extensionRoot, 'runtime');
   const previousRuntime = path.join(context.extensionRoot, 'slots', 'previous', 'runtime');
+  // An early interrupted apply may still have the source in the current slot.
+  // A missing previous slot is recoverable only when these actual bytes match
+  // the source pair; the source manifest and markers alone are insufficient.
+  const source = readManagedRuntimeEvidence(context, journal.sourceVersion,
+    fs.existsSync(previousRuntime) ? previousRuntime : runtime);
+  if (journal.bootstrapMigration) BootstrapUpdate.restoreBootstrap(context, journal);
   if (fs.existsSync(previousRuntime)) {
     fs.rmSync(runtime, { recursive: true, force: true });
     fs.renameSync(previousRuntime, runtime);
@@ -793,7 +1012,7 @@ function rollbackFiles(context, journal) {
   if (journal.previousManifest) {
     atomicWriteText(path.join(context.extensionRoot, 'manifest.json'), journal.previousManifest);
   }
-  if (parseSemver(journal.sourceVersion)) {
+  if (parseSemver(journal.sourceVersion) && !options.deferSourceActivation) {
     atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
   }
   const sourcePrevious = parseSemver(journal.sourcePreviousVersion) ? journal.sourcePreviousVersion : '';
@@ -805,6 +1024,18 @@ function rollbackFiles(context, journal) {
   if (parseSemver(journal.sourceVersion)) {
     syncManagedMarkerVersions(context, journal.sourceVersion);
   }
+  const restored = readManagedRuntimeEvidence(context, journal.sourceVersion);
+  if (!sameRuntimeEvidence(source, restored)) {
+    throw updateError('update_rollback_unconfirmed', 'The source runtime readback did not match the restored files.');
+  }
+  if (journal.bootstrapMigration) {
+    const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+    if (bootstrap) {
+      restored.bootstrapSha256 = bootstrap.digest;
+      if (bootstrap.unmodified) restored.bootstrapSourceUnchanged = true;
+    }
+  }
+  return restored;
 }
 
 function syncManagedMarkerVersions(context, version) {
@@ -843,8 +1074,11 @@ function cleanupOrphanStageRoots(updatesRoot, retainedRoots = []) {
   }
 }
 
-function recoverAndReadStatus(context) {
+function recoverAndReadStatus(context, params = {}) {
   let journal = readJournal(context);
+  if (journal?.sourceActivationPending && journal.state === 'rolled_back') {
+    journal = finishSourceActivation(context, journal);
+  }
   const alignedVersion = readAlignedManagedVersion(context);
   journal = supersedeObsoleteJournal(context, journal, alignedVersion);
   if (journal?.state === 'activation_pending') {
@@ -852,33 +1086,134 @@ function recoverAndReadStatus(context) {
     writeJournal(context, journal);
   }
   if (journal?.state === 'applying') {
-    rollbackFiles(context, journal);
-    journal = { ...journal, state: 'rolled_back', reasonCode: 'update_interrupted', updatedAt: new Date().toISOString() };
+    const rollbackEvidence = rollbackFiles(context, journal);
+    journal = { ...journal, rollbackEvidence, state: 'rolled_back', reasonCode: 'update_interrupted', updatedAt: new Date().toISOString() };
     writeJournal(context, journal);
     settleAuthorization(context, journal.authorizationId, 'revoked');
   }
+  journal = BootstrapUpdate.bindBootstrapMigration(context, journal, bootstrapDependencies(context));
+  if (BootstrapUpdate.bootstrapExpired(journal, { recoveryRequested: params.bootstrapRecovery === true, context })) {
+    try {
+      rollbackUpdate(context, { transactionId: journal.id, expectedState: journal.state, reasonCode: 'update_bootstrap_health_timeout' });
+    } catch (_error) {
+      // Recorded as rollbackFailure on the journal; status still answers so
+      // the browser can show the reason instead of an unreadable state.
+    }
+    journal = readJournal(context);
+  }
   if (journal?.state === 'rolled_back' || journal?.state === 'superseded') {
+    if (journal.state === 'superseded') cleanupStage(journal.stageRoot);
     pruneNativeVersions(context.nativeRoot, new Set([
       readVersionPointer(context.nativeRoot, 'active-version'),
       readVersionPointer(context.nativeRoot, 'previous-version')
     ]));
   }
+  if (journal?.state === 'committed' && journal.committedEvidence && alignedVersion === journal.targetVersion) {
+    const observed = readManagedRuntimeEvidence(context, journal.targetVersion);
+    if (sameRuntimeEvidence(journal.committedEvidence, observed)) {
+      if (journal.bootstrapMigration) BootstrapUpdate.assertBootstrapConfirmation(context, journal,
+        { bootstrapRevision: journal.bootstrapMigration.targetRevision });
+      const authorization = readAuthorization(context);
+      if (['bound', 'consumed'].includes(authorization?.state) && authorization.id === journal.authorizationId
+        && authorization.transactionId === journal.id && authorization.sourceVersion === journal.sourceVersion
+        && authorization.targetVersion === journal.targetVersion) {
+        settleAuthorization(context, journal.authorizationId, 'consumed');
+      }
+      cleanupStage(journal.stageRoot);
+    }
+  }
   return currentStatus(context, journal);
 }
 
+function finishSourceActivation(context, journal) {
+  const actual = readManagedRuntimeEvidence(context, journal.sourceVersion);
+  if (!sameRuntimeEvidence(actual, journal.rollbackEvidence)) {
+    throw updateError('update_rollback_unconfirmed', 'The recovered source files changed before activation.');
+  }
+  const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+  if (journal.bootstrapMigration
+    && (!bootstrap?.digest || bootstrap.digest !== journal.rollbackEvidence?.bootstrapSha256)) {
+    throw updateError('update_bootstrap_source_mismatch', 'The recovered Bootstrap bytes changed before activation.');
+  }
+  settleAuthorization(context, journal.authorizationId, 'revoked');
+  atomicWriteText(path.join(context.nativeRoot, 'active-version'), journal.sourceVersion + '\n');
+  const finished = { ...journal, sourceActivationPending: false };
+  writeJournal(context, finished);
+  cleanupStage(journal.stageRoot);
+  return finished;
+}
+
+// Called by the full installer while holding the same mutation lock, only
+// after both runtime trees and browser registration have succeeded.
+function settleReinstalledUpdate(context, version, expected) {
+  if (!expected?.id || !parseSemver(expected.sourceVersion) || !parseSemver(expected.targetVersion)
+    || compareSemver(version, expected.targetVersion) < 0
+    || compareSemver(version, expected.sourceVersion) <= 0) return;
+  const journal = readJournal(context);
+  if (!journal || ['id', 'state', 'sourceVersion', 'targetVersion'].some(key => journal[key] !== expected[key])) {
+    throw updateError('update_transaction_mismatch', 'The update transaction changed during full installation.');
+  }
+  if (assertManagedLayout(context) !== version) {
+    throw updateError('update_managed_layout_invalid', 'Full installation did not produce the requested pair.');
+  }
+  const reinstalledPair = readManagedRuntimeEvidence(context, version);
+  const timestamp = new Date().toISOString();
+  // The installer already activated `version`; a pending switch back to the
+  // source would block business requests and could repoint the launcher.
+  writeJournal(context, {
+    ...journal, state: 'superseded', supersededFromState: journal.state,
+    supersededByVersion: version, supersededAt: timestamp,
+    updatedAt: timestamp, reasonCode: 'update_reinstalled', reinstalledPair,
+    sourceActivationPending: false
+  });
+  const authorization = readAuthorization(context);
+  if (authorization?.state === 'bound' && authorization.id === journal.authorizationId
+    && authorization.transactionId === journal.id && authorization.sourceVersion === journal.sourceVersion
+    && authorization.targetVersion === journal.targetVersion) {
+    settleAuthorization(context, authorization.id, 'revoked');
+  }
+}
+
 function currentStatus(context, journal = readJournal(context)) {
+  let restoredPair = null;
+  let reinstalledPair = null;
+  if (journal?.state === 'rolled_back') {
+    try {
+      const observed = readManagedRuntimeEvidence(context, journal.sourceVersion);
+      if (!journal.rollbackEvidence || sameRuntimeEvidence(journal.rollbackEvidence, observed)) {
+        if (journal.bootstrapMigration) {
+          const bootstrap = BootstrapUpdate.bootstrapEvidence(context, journal, 'source');
+          if (bootstrap) observed.bootstrapSha256 = bootstrap.digest;
+          if (journal.rollbackEvidence?.bootstrapSha256 !== observed.bootstrapSha256) throw new Error('Bootstrap restoration changed.');
+        }
+        restoredPair = observed;
+      }
+    } catch (_) { /* Missing or changed bytes cannot confirm a recovered pair. */ }
+  }
+  if (journal?.state === 'superseded' && journal.reasonCode === 'update_reinstalled' && journal.reinstalledPair) {
+    try {
+      const observed = readManagedRuntimeEvidence(context, journal.supersededByVersion);
+      if (sameRuntimeEvidence(journal.reinstalledPair, observed)) reinstalledPair = observed;
+    } catch (_) { /* A reinstall receipt cannot authenticate later changed files. */ }
+  }
   return {
     managed: true,
     activeVersion: readVersionPointer(context.nativeRoot, 'active-version'),
     runtimeVersion: context.env?.CODEX_OVERLEAF_ACTIVE_VERSION || RUNNING_VERSION,
     installedAligned: Boolean(readAlignedManagedVersion(context)),
     previousVersion: readVersionPointer(context.nativeRoot, 'previous-version'),
-    transaction: journal ? publicTransaction(journal) : null,
-    authorization: publicAuthorization(readAuthorization(context))
+    transaction: journal ? { ...publicTransaction(journal),
+      ...(journal.state === 'awaiting_health' && BootstrapUpdate.migrationHint(context, journal)
+        && journal.bootstrapMigration?.phase !== 'loaded' ? { state: 'bootstrap_pending' } : {}) } : null,
+    authorization: publicAuthorization(readAuthorization(context)),
+    rollbackAvailable: userRollbackAvailable(context, journal)
+      ? { transactionId: journal.id, sourceVersion: journal.sourceVersion, targetVersion: journal.targetVersion } : null,
+    restoredPair,
+    reinstalledPair
   };
 }
 
-function readStatusWithoutWaiting(context) {
+function readStatusWithoutWaiting(context, params = {}) {
   const lockPath = path.join(context.updatesRoot, MUTATION_LOCK_FILE);
   const token = crypto.randomUUID();
   let descriptor;
@@ -888,7 +1223,7 @@ function readStatusWithoutWaiting(context) {
     if (error.code !== 'EEXIST') throw error;
     const owner = readJsonSafe(lockPath, null);
     if (Number.isInteger(owner?.pid) && !isProcessAlive(owner.pid) && removeStaleUpdateFileLock(lockPath)) {
-      return readStatusWithoutWaiting(context);
+      return readStatusWithoutWaiting(context, params);
     }
     // A live mutation owns recovery; report an atomic-file snapshot without
     // queueing behind its network transfer or changing its journal.
@@ -897,7 +1232,7 @@ function readStatusWithoutWaiting(context) {
   try {
     fs.writeFileSync(descriptor, JSON.stringify({ token, pid: process.pid,
       createdAt: Date.now(), expiresAt: Date.now() + MUTATION_LOCK_STALE_MS }));
-    return recoverAndReadStatus(context);
+    return recoverAndReadStatus(context, params);
   } finally {
     fs.closeSync(descriptor);
     releaseUpdateFileLock({ lockPath, token });
@@ -913,12 +1248,21 @@ function readAlignedManagedVersion(context) {
 }
 
 function supersedeObsoleteJournal(context, journal, activeVersion) {
-  if (!journal || journal.state === 'superseded' || !parseSemver(activeVersion) ||
+  if (!journal || !parseSemver(activeVersion) ||
       !parseSemver(journal.sourceVersion) || !parseSemver(journal.targetVersion) ||
       compareSemver(activeVersion, journal.sourceVersion) <= 0 ||
       compareSemver(activeVersion, journal.targetVersion) <= 0) {
     return journal;
   }
+  // A previous runtime may already have retired the journal without settling
+  // its bound authorization. Never consume an authorization owned elsewhere.
+  const authorization = readAuthorization(context);
+  if (authorization?.state === 'bound' && journal.authorizationId
+      && authorization.id === journal.authorizationId && authorization.transactionId === journal.id
+      && authorization.sourceVersion === journal.sourceVersion && authorization.targetVersion === journal.targetVersion) {
+    settleAuthorization(context, authorization.id, 'revoked');
+  }
+  if (journal.state === 'superseded') return journal;
   const timestamp = new Date().toISOString();
   const superseded = {
     ...journal,
@@ -1098,6 +1442,7 @@ function publicTransaction(journal) {
     state: journal.state,
     sourceVersion: journal.sourceVersion,
     targetVersion: journal.targetVersion,
+    ...(journal.bootstrapMigration ? { bootstrapRevision: journal.bootstrapMigration.targetRevision } : {}),
     createdAt: journal.createdAt,
     activationRequestedAt: journal.activationRequestedAt,
     appliedAt: journal.appliedAt,
@@ -1106,7 +1451,8 @@ function publicTransaction(journal) {
     supersededAt: journal.supersededAt,
     supersededByVersion: journal.supersededByVersion,
     supersededFromState: journal.supersededFromState,
-    reasonCode: journal.reasonCode || ''
+    reasonCode: journal.reasonCode || '',
+    rollbackFailureCode: journal.rollbackFailure?.code || ''
   };
 }
 
@@ -1189,10 +1535,22 @@ function atomicWriteJson(target, value) {
 }
 
 function atomicWriteText(target, value) {
-  const temp = target + '.tmp-' + process.pid + '-' + Date.now();
+  const temp = target + '.tmp-' + process.pid + '-' + crypto.randomBytes(6).toString('hex');
   fs.mkdirSync(path.dirname(target), { recursive: true });
-  fs.writeFileSync(temp, value, { mode: 0o600 });
+  let descriptor = fs.openSync(temp, 'wx', 0o600);
+  try {
+    // Windows requires a writable handle for FlushFileBuffers (Node fsync).
+    fs.writeFileSync(descriptor, value);
+    fs.fsyncSync(descriptor);
+  } finally { if (descriptor !== undefined) fs.closeSync(descriptor); }
   fs.renameSync(temp, target);
+  descriptor = undefined;
+  try {
+    descriptor = fs.openSync(path.dirname(target), 'r');
+    fs.fsyncSync(descriptor);
+  } catch (error) {
+    if (process.platform !== 'win32' || !['EPERM', 'EISDIR', 'EINVAL', 'EBADF', 'EACCES'].includes(error.code)) throw error;
+  } finally { if (descriptor !== undefined) fs.closeSync(descriptor); }
 }
 
 function readJsonSafe(target, fallback) {
@@ -1246,8 +1604,10 @@ function errorResponse(id, code, message) {
 
 module.exports = {
   GITHUB_LATEST_URL,
+  MUTATION_LOCK_STALE_MS,
   applyStagedUpdate,
   assertManagedLayout,
+  assertBootstrapBusinessAvailable,
   authorizeUpdate,
   checkForUpdate,
   cleanupOrphanStageRoots,
@@ -1257,8 +1617,11 @@ module.exports = {
   handleUpdateRequest,
   isUpdateMethod,
   revokeUpdate,
+  removeStaleUpdateFileLock,
+  recoverBootstrapTransaction,
   rollbackUpdate,
   scheduleStagedActivation,
+  settleReinstalledUpdate,
   stageCandidate,
   syncManagedMarkerVersions
 };