craft-native 0.0.464 → 0.0.467

package/dist/android/templates/CraftNativeServices.kt.template

@@ -120,6 +120,7 @@ internal class CraftNativeServices(
         // Videos kept on the phone for offline (CraftNativeMedia).
         add("media")
         add("media-cache-key")
+        add("media-remove")
         if (config.optBoolean("enableShare")) add("share")
         if (config.optBoolean("enablePushNotifications")) add("push")
         if (health != null || healthServices != null) {
@@ -188,7 +189,22 @@ internal class CraftNativeServices(
                         done(success(CraftNativeMedia.prune(context, (0 until keep.length()).map { index -> keep.optJSONObject(index)?.let { CraftNativeMedia.identity(it.optString("url"), it) } ?: keep.optString(index) })))
                     }
                     "usage" -> done(success(CraftNativeMedia.usage(context)))
-                    "clear" -> done(success(CraftNativeMedia.clear(context)))
+                    "clear" -> {
+                        try { done(success(CraftNativeMedia.clear(context))) }
+                        catch (error: java.io.IOException) { done(failure("IO_ERROR", error.message ?: "The media cache could not be cleared")) }
+                    }
+                    "remove" -> {
+                        val options = args.optJSONObject(1)
+                        val key = options?.opt("cacheKey")
+                        if (key != null && key != JSONObject.NULL && (key !is String || key.isEmpty() || key.toByteArray().size > 1024)) {
+                            done(failure("INVALID_ARGUMENT", "media.remove cacheKey must be a nonempty string of at most 1024 bytes"))
+                        } else {
+                            val address = CraftNativeMedia.identity(args.optString(0), options)
+                            if (address.isBlank()) done(failure("INVALID_ARGUMENT", "media.remove needs a source or cache key"))
+                            else try { done(success(CraftNativeMedia.remove(context, address))) }
+                            catch (error: java.io.IOException) { done(failure("IO_ERROR", error.message ?: "The media copy could not be removed")) }
+                        }
+                    }
                     else -> done(failure("UNKNOWN_ACTION", "Unsupported Media method"))
                 }
                 "Background" -> {

package/dist/android/templates/CraftNativeShell.kt.template

@@ -1381,7 +1381,7 @@ internal object CraftNativeMedia {
     private const val PREFS = "craft.media"
     private val lock = Any()
     /** Keeps waiting in this process for an address's transfer. */
-    private data class Waiting(val generation: Int, val answer: (CraftNativeCapabilityResult) -> Unit)
+    private data class Waiting(val generation: Int, val revision: String, val answer: (CraftNativeCapabilityResult) -> Unit)
     private val waiting = HashMap<String, MutableList<Waiting>>()
     /** One transfer writes an address's part file at a time. */
     private val writers = ConcurrentHashMap<String, Any>()
@@ -1400,10 +1400,12 @@ internal object CraftNativeMedia {
     }
 
     /** Where an address's transfer writes until the file is whole; kept between attempts to resume. */
-    fun part(context: Context, address: String): File = File(root(context), "${file(context, address).name}.part")
+    fun part(context: Context, address: String, started: Int = generation(context), ownerRevision: String = revision(context, address)): File =
+        File(root(context), "${file(context, address).name}.g$started.r${ownerRevision.ifEmpty { "legacy" }}.part")
 
-    fun local(context: Context, address: String): File? =
-        address.takeIf { it.isNotBlank() }?.let { file(context, it) }?.takeIf { it.isFile && it.length() > 0 }
+    fun local(context: Context, address: String): File? = synchronized(lock) {
+        address.takeIf { it.isNotBlank() && permitted(context, it) }?.let { file(context, it) }?.takeIf { it.isFile && it.length() > 0 }
+    }
 
     private fun describe(address: String, file: File) = JSONObject().put("ok", true).put("url", address).put("path", file.absolutePath).put("size", file.length())
 
@@ -1412,6 +1414,46 @@ internal object CraftNativeMedia {
     /** How many times the cache was cleared; a transfer started before the last clear does not land. */
     fun generation(context: Context): Int = prefs(context).getInt("generation", 0)
 
+    private fun revision(context: Context, address: String): String = prefs(context).getString("revision:${digest(address)}", "").orEmpty()
+
+    private fun permitted(context: Context, address: String): Boolean {
+        val store = prefs(context)
+        val key = digest(address)
+        return !store.getBoolean("revoked:$key", false) && (!store.getBoolean("cleared", false) || store.getBoolean("authorized:$key", false))
+    }
+
+    private fun current(context: Context, address: String, started: Int, ownerRevision: String): Boolean =
+        generation(context) == started && revision(context, address) == ownerRevision && permitted(context, address)
+
+    private fun mediaFiles(context: Context): Array<File> {
+        val directory = root(context)
+        if (!directory.exists()) return emptyArray()
+        return directory.listFiles() ?: throw java.io.IOException("The media cache could not be read")
+    }
+
+    private fun removeFiles(context: Context, address: String): Int {
+        val prefix = digest(address) + "."
+        var removed = 0
+        var failure: java.io.IOException? = null
+        mediaFiles(context).filter { it.name.startsWith(prefix) }.forEach { file ->
+            if (file.delete()) removed++ else failure = java.io.IOException("The media copy could not be removed")
+        }
+        failure?.let { throw it }
+        return removed
+    }
+
+    /** A new explicit authorized keep may lift a durable tombstone, after removing retired bytes. */
+    private fun activate(context: Context, address: String) {
+        if (permitted(context, address)) return
+        removeFiles(context, address)
+        val key = digest(address)
+        if (!prefs(context).edit().putBoolean("revoked:$key", false).putBoolean("authorized:$key", true).commit()) {
+            throw java.io.IOException("Media authorization could not be persisted")
+        }
+    }
+
+    private fun revisionTag(address: String, revision: String) = "$TAG:identity:${digest(address)}:${revision.ifEmpty { "legacy" }}"
+
     /** The unique job for an address and connection rule: `any` or `wifi`. */
     private fun workName(address: String, wifiOnly: Boolean) = "$TAG:${digest(address)}:${if (wifiOnly) "wifi" else "any"}"
 
@@ -1423,7 +1465,10 @@ internal object CraftNativeMedia {
         }
         val app = context.applicationContext
         var sourceChanged = false
+        var ownerRevision = ""
         val started = synchronized(lock) {
+            try { activate(app, address) }
+            catch (error: java.io.IOException) { return done(CraftNativeCapabilityResult(code = "IO_ERROR", message = error.message ?: "Media authorization could not be persisted")) }
             local(app, address)?.let { return done(CraftNativeCapabilityResult(data = describe(address, it))) }
             if (cacheKey != null) {
                 val sourceKey = "source:${digest(address)}"
@@ -1431,7 +1476,8 @@ internal object CraftNativeMedia {
                 sourceChanged = prefs(app).getString(sourceKey, null) != authorization
                 if (!prefs(app).edit().putString(sourceKey, authorization).commit()) return done(CraftNativeCapabilityResult(code = "IO_ERROR", message = "Could not persist media authorization"))
             }
-            generation(app).also { waiting.getOrPut(address) { mutableListOf() }.add(Waiting(it, done)) }
+            ownerRevision = revision(app, address)
+            generation(app).also { waiting.getOrPut(address) { mutableListOf() }.add(Waiting(it, ownerRevision, done)) }
         }
         val wifiOnly = !cellular
         val work = androidx.work.WorkManager.getInstance(app)
@@ -1439,20 +1485,22 @@ internal object CraftNativeMedia {
         work.cancelUniqueWork(workName(address, !wifiOnly))
         val request = androidx.work.OneTimeWorkRequestBuilder<CraftNativeMediaWorker>()
             .setConstraints(androidx.work.Constraints.Builder().setRequiredNetworkType(if (wifiOnly) androidx.work.NetworkType.UNMETERED else androidx.work.NetworkType.CONNECTED).build())
-            .setInputData(androidx.work.workDataOf("address" to address, "source" to source, "headers" to headers.toString(), "generation" to started))
+            .setInputData(androidx.work.workDataOf("address" to address, "source" to source, "headers" to headers.toString(), "generation" to started, "revision" to ownerRevision))
             .setBackoffCriteria(androidx.work.BackoffPolicy.EXPONENTIAL, 30, java.util.concurrent.TimeUnit.SECONDS)
             .addTag(TAG)
             .addTag("$TAG:generation:$started")
             .addTag("$TAG:${digest(address)}")
+            .addTag(revisionTag(address, ownerRevision))
             .build()
         // Join a running or freshly queued transfer. Only a failed attempt's
         // backoff is replaced so an explicit retry can resume immediately.
         val name = workName(address, wifiOnly)
         background.execute {
             try {
-                if (generation(app) == started) {
+                if (current(app, address, started, ownerRevision)) {
                     val pending = work.getWorkInfosForUniqueWork(name).get().any {
                         "$TAG:generation:$started" in it.tags &&
+                            revisionTag(address, ownerRevision) in it.tags &&
                             !sourceChanged && !it.progress.getBoolean(ATTEMPT_SETTLED, false) &&
                             (it.state == androidx.work.WorkInfo.State.RUNNING ||
                                 (it.state == androidx.work.WorkInfo.State.ENQUEUED && it.runAttemptCount == 0))
@@ -1462,8 +1510,8 @@ internal object CraftNativeMedia {
                 }
             } catch (error: Exception) {
                 if (error is InterruptedException) Thread.currentThread().interrupt()
-                if (generation(app) == started) {
-                    deliver(context, address, started, CraftNativeCapabilityResult(code = "IO_ERROR", message = "media.keep could not schedule the download"))
+                if (current(app, address, started, ownerRevision)) {
+                    deliver(context, address, started, CraftNativeCapabilityResult(code = "IO_ERROR", message = "media.keep could not schedule the download"), ownerRevision)
                 }
             }
         }
@@ -1472,25 +1520,25 @@ internal object CraftNativeMedia {
             wifiOnly && metered(app) -> "cellular"
             else -> null
         }
-        if (reason != null) deliver(context, address, started, queued(address, reason))
+        if (reason != null) deliver(context, address, started, queued(address, reason), ownerRevision)
     }
 
     private fun queued(address: String, reason: String) =
         CraftNativeCapabilityResult(data = JSONObject().put("ok", false).put("url", address).put("reason", reason).put("queued", true))
 
     /** Answers only keeps belonging to this transfer's cache generation. */
-    fun deliver(context: Context, address: String, started: Int, result: CraftNativeCapabilityResult) {
+    fun deliver(context: Context, address: String, started: Int, result: CraftNativeCapabilityResult, ownerRevision: String = "") {
         val answered = synchronized(lock) {
             val pending = waiting[address].orEmpty()
-            val matching = pending.filter { it.generation == started }
-            val remaining = pending.filter { it.generation != started }.toMutableList()
+            val matching = pending.filter { it.generation == started && it.revision == ownerRevision }
+            val remaining = pending.filter { it.generation != started || it.revision != ownerRevision }.toMutableList()
             if (remaining.isEmpty()) waiting.remove(address) else waiting[address] = remaining
             matching
         }
         if (answered.isNotEmpty()) main.post {
-            val current = if (generation(context) == started) result else
+            val answer = if (current(context, address, started, ownerRevision)) result else
                 CraftNativeCapabilityResult(code = "CANCELLED", message = "The video cache was cleared")
-            answered.forEach { it.answer(current) }
+            answered.forEach { it.answer(answer) }
         }
     }
 
@@ -1501,7 +1549,7 @@ internal object CraftNativeMedia {
      * file where it stopped, moves it into place whole, and answers whoever
      * waits. RETRY leaves the part file for the next attempt.
      */
-    fun transfer(context: Context, address: String, headers: JSONObject, started: Int, attempt: Int, source: String = address, beforeAnswer: () -> Unit = {}, stopped: () -> Boolean): Outcome {
+    fun transfer(context: Context, address: String, headers: JSONObject, started: Int, attempt: Int, source: String = address, beforeAnswer: () -> Unit = {}, ownerRevision: String = "", stopped: () -> Boolean): Outcome {
         fun answer(result: CraftNativeCapabilityResult) {
             // The callback can immediately call keep again. Publish completion
             // before that callback, while WorkManager may still say RUNNING.
@@ -1509,12 +1557,15 @@ internal object CraftNativeMedia {
                 // A keep registered after this marker belongs to the next
                 // attempt; it must not enter the old callback batch.
                 beforeAnswer()
-                deliver(context, address, started, result)
+                deliver(context, address, started, result, ownerRevision)
             }
         }
         // clear() already answered the old generation's waiters. Never answer
         // a new athlete's waiters from an obsolete worker for the same URL.
-        if (generation(context) != started) return Outcome.DONE
+        if (!current(context, address, started, ownerRevision)) {
+            part(context, address, started, ownerRevision).delete()
+            return Outcome.DONE
+        }
         local(context, address)?.let {
             answer(CraftNativeCapabilityResult(data = describe(address, it)))
             return Outcome.DONE
@@ -1523,21 +1574,25 @@ internal object CraftNativeMedia {
         synchronized(writer) {
             // Another worker can finish, or sign-out can clear the cache, while
             // this worker waits for the address's writer.
-            if (generation(context) != started) return Outcome.DONE
+            if (!current(context, address, started, ownerRevision)) {
+                part(context, address, started, ownerRevision).delete()
+                return Outcome.DONE
+            }
             if (stopped()) return Outcome.RETRY
             local(context, address)?.let {
                 answer(CraftNativeCapabilityResult(data = describe(address, it)))
                 return Outcome.DONE
             }
             val target = file(context, address)
-            val staging = part(context, address)
+            val staging = part(context, address, started, ownerRevision)
             target.parentFile?.mkdirs()
             val download = CraftResumableDownload()
             val asked = headers.keys().asSequence().associateWith { headers.optString(it) }
             val fetched = try {
                 // A part that no longer lines up was dropped: the whole file, now, not after a backoff.
-                download.fetch(source, asked, staging, stopped).let { first ->
-                    if (first is CraftResumableDownload.Fetched.Restart) download.fetch(source, asked, staging, stopped) else first
+                val retired = { stopped() || !current(context, address, started, ownerRevision) }
+                download.fetch(source, asked, staging, retired).let { first ->
+                    if (first is CraftResumableDownload.Fetched.Restart) download.fetch(source, asked, staging, retired) else first
                 }
             } catch (error: Exception) {
                 val full = generateSequence<Throwable>(error) { it.cause }.take(16).any {
@@ -1548,13 +1603,17 @@ internal object CraftNativeMedia {
                     answer(CraftNativeCapabilityResult(code = "NO_SPACE", message = error.message ?: "The phone is out of space"))
                     return Outcome.DONE
                 }
+                if (!current(context, address, started, ownerRevision)) { staging.delete(); return Outcome.DONE }
                 if (stopped()) return Outcome.RETRY
                 // Lost the connection part way: the part waits for the next attempt.
                 answer(if (!online(context)) queued(address, "offline") else CraftNativeCapabilityResult(code = if (error is java.net.SocketTimeoutException) "TIMEOUT" else "NETWORK_ERROR", message = error.message ?: "media.keep failed"))
                 return if (attempt < 8) Outcome.RETRY else Outcome.DONE.also { staging.delete() }
             }
             when (fetched) {
-                is CraftResumableDownload.Fetched.Stopped, is CraftResumableDownload.Fetched.Restart -> return Outcome.RETRY
+                is CraftResumableDownload.Fetched.Stopped, is CraftResumableDownload.Fetched.Restart -> {
+                    if (!current(context, address, started, ownerRevision)) { staging.delete(); return Outcome.DONE }
+                    return Outcome.RETRY
+                }
                 is CraftResumableDownload.Fetched.Refused -> {
                     answer(CraftNativeCapabilityResult(data = JSONObject().put("ok", false).put("url", address).put("status", fetched.status)))
                     return Outcome.DONE
@@ -1566,7 +1625,7 @@ internal object CraftNativeMedia {
                 is CraftResumableDownload.Fetched.Complete -> Unit
             }
             synchronized(lock) {
-                if (generation(context) != started) {
+                if (!current(context, address, started, ownerRevision)) {
                     staging.delete()
                     return Outcome.DONE
                 }
@@ -1603,8 +1662,8 @@ internal object CraftNativeMedia {
             val active = waiting.keys.map { digest(it) }.toSet()
             root(context).listFiles()?.forEach { file ->
                 val owner = file.name.substringBefore('.')
-                // Part files from before transfers resumed (`<sha>.<ext>.<id>.part`) are never picked up again.
-                val stale = file.name.endsWith(".part") && file.name.count { it == '.' } > 2
+                val ownerRevision = prefs(context).getString("revision:$owner", "").orEmpty().ifEmpty { "legacy" }
+                val stale = file.name.endsWith(".part") && !file.name.endsWith(".g${generation(context)}.r$ownerRevision.part")
                 if (owner !in active && (owner !in wanted || stale) && file.delete()) removed++
             }
         }
@@ -1628,20 +1687,60 @@ internal object CraftNativeMedia {
         return removed
     }
 
+    /** Revoke one identity before cancelling its work or unlinking its bytes. */
+    fun remove(context: Context, address: String): Int {
+        require(address.isNotBlank()) { "media.remove needs a source or cache key" }
+        var removed = 0
+        var failure: java.io.IOException? = null
+        val key = digest(address)
+        val answered = synchronized(lock) {
+            if (!prefs(context).edit().putString("revision:$key", java.util.UUID.randomUUID().toString()).putBoolean("revoked:$key", true).commit()) {
+                failure = java.io.IOException("Media retirement could not be persisted")
+            }
+            val callbacks = waiting.remove(address).orEmpty()
+            try { removed = removeFiles(context, address) }
+            catch (error: java.io.IOException) { failure = error }
+            callbacks
+        }
+        main.post { answered.forEach { it.answer(CraftNativeCapabilityResult(code = "CANCELLED", message = "Media ownership was retired")) } }
+        val app = context.applicationContext
+        background.execute {
+            runCatching {
+                val work = androidx.work.WorkManager.getInstance(app)
+                work.getWorkInfosByTag("$TAG:$key").get().filter { !it.state.isFinished }.forEach { info ->
+                    synchronized(lock) {
+                        // A delayed enumeration must preserve a later explicit
+                        // re-grant, including one made after another remove.
+                        if (!permitted(app, address) || "$TAG:generation:${generation(app)}" !in info.tags || revisionTag(address, revision(app, address)) !in info.tags) {
+                            work.cancelWorkById(info.id)
+                        }
+                    }
+                }
+            }
+        }
+        failure?.let { throw it }
+        return removed
+    }
+
     /** Stops every transfer and deletes every copy; none started before this lands after it. */
     fun clear(context: Context): Int {
         var removed = 0
         var failure: java.io.IOException? = null
         val answered = synchronized(lock) {
             // Persisted before the files go: a transfer that outlives the process checks it too.
-            prefs(context).edit().putInt("generation", generation(context) + 1).commit()
+            val previous = generation(context)
+            if (!prefs(context).edit().clear().putInt("generation", previous + 1).putBoolean("cleared", true).commit()) {
+                failure = java.io.IOException("Media retirement could not be persisted")
+            }
             val callbacks = waiting.values.flatten()
             waiting.clear()
-            root(context).listFiles()?.forEach { file ->
-                if (file.delete()) removed++ else failure = java.io.IOException("The video cache could not be cleared")
-            }
+            try {
+                mediaFiles(context).forEach { file ->
+                    if (file.delete()) removed++ else failure = java.io.IOException("The video cache could not be cleared")
+                }
+            } catch (error: java.io.IOException) { failure = error }
             // Schedule cancellation before a new generation can enqueue its work.
-            androidx.work.WorkManager.getInstance(context.applicationContext).cancelAllWorkByTag(TAG)
+            androidx.work.WorkManager.getInstance(context.applicationContext).cancelAllWorkByTag("$TAG:generation:$previous")
             callbacks
         }
         main.post { answered.forEach { it.answer(CraftNativeCapabilityResult(code = "CANCELLED", message = "The video cache was cleared")) } }
@@ -1733,10 +1832,11 @@ internal class CraftNativeMediaWorker(context: Context, parameters: androidx.wor
         val address = inputData.getString("address") ?: return Result.failure()
         val headers = runCatching { JSONObject(inputData.getString("headers") ?: "{}") }.getOrDefault(JSONObject())
         val started = inputData.getInt("generation", 0)
+        val ownerRevision = inputData.getString("revision").orEmpty()
         return try {
             setProgressAsync(androidx.work.workDataOf(CraftNativeMedia.ATTEMPT_SETTLED to false)).get()
             val outcome = CraftNativeMedia.transfer(applicationContext, address, headers, started, runAttemptCount, source = inputData.getString("source") ?: address,
-                beforeAnswer = { setProgressAsync(androidx.work.workDataOf(CraftNativeMedia.ATTEMPT_SETTLED to true)).get() }
+                beforeAnswer = { setProgressAsync(androidx.work.workDataOf(CraftNativeMedia.ATTEMPT_SETTLED to true)).get() }, ownerRevision = ownerRevision
             ) { isStopped }
             if (outcome == CraftNativeMedia.Outcome.RETRY) Result.retry() else Result.success()
         } catch (error: Exception) {
@@ -1744,7 +1844,7 @@ internal class CraftNativeMediaWorker(context: Context, parameters: androidx.wor
             // A replacement owns the address's new waiters. A real progress
             // storage failure still needs an answer instead of a lost callback.
             if (!isStopped) CraftNativeMedia.deliver(applicationContext, address, started,
-                CraftNativeCapabilityResult(code = "IO_ERROR", message = error.message ?: "media.keep could not store worker progress"))
+                CraftNativeCapabilityResult(code = "IO_ERROR", message = error.message ?: "media.keep could not store worker progress"), ownerRevision)
             if (isStopped) Result.retry() else Result.failure()
         }
     }

package/dist/cli.js

@@ -3228,7 +3228,7 @@ function pinCraftNativeDependency(packagePath, craftVersion) {
 `);
 }
 // package.json
-var version = "0.0.464";
+var version = "0.0.467";
 
 // bin/cli.ts
 var spawnedFrom = process6.env[CRAFT_CLI_SPAWN_MARKER];

package/dist/index.cjs

@@ -376,7 +376,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.464";
+var version = "0.0.467";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/index.js

@@ -117,7 +117,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.464";
+var version = "0.0.467";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/ios/src/index.js

@@ -1611,6 +1611,7 @@ function writeShell(output, config) {
   writeSource(join4(output, "Sources", "CraftNativeUI.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftNativeUI.swift"), "utf8"));
   writeSource(join4(output, "Sources", "CraftNativeServices.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftNativeServices.swift"), "utf8"));
   writeSource(join4(output, "Sources", "CraftNativeFiles.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftNativeFiles.swift"), "utf8"));
+  writeSource(join4(output, "Sources", "CraftNativeMediaOwnership.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftNativeMediaOwnership.swift"), "utf8"));
   writeSource(join4(output, "Sources", "CraftVoiceRecording.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftVoiceRecording.swift"), "utf8"));
   writeSource(join4(output, "Sources", "CraftWebAudio.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftWebAudio.swift"), "utf8"));
   writeSource(join4(output, "Sources", "CraftHybrid.swift"), readFileSync3(join4(TEMPLATES_DIR, "CraftHybrid.swift"), "utf8"));

package/dist/ios/templates/CraftNativeActions.swift

@@ -109,6 +109,7 @@ enum CraftNativeActions {
         // which the native Video element plays in place of the address.
         values.append("media")
         values.append("media-cache-key")
+        values.append("media-remove")
         if config.enableCamera { values.append("camera") }
         if config.enableAudioRecording { values.append("audioRecording") }
         // craft.crashReporter: the app's crash and error reporter (bughq).
@@ -333,6 +334,24 @@ enum CraftNativeActions {
             return
         case ("Media", "path"):
             sync = .success(CraftNativeMedia.local(CraftNativeMedia.identity(args.first as? String ?? "", options: args.count > 1 ? args[1] as? [String: Any] ?? [:] : [:]))?.path ?? NSNull())
+        case ("Media", "remove"):
+            let options = args.count > 1 ? args[1] as? [String: Any] ?? [:] : [:]
+            if let value = options["cacheKey"], !(value is NSNull) {
+                guard let key = value as? String, !key.isEmpty, key.utf8.count <= 1024 else {
+                    sync = failure("INVALID_ARGUMENT", "media.remove cacheKey must be a nonempty string of at most 1024 bytes")
+                    break
+                }
+            }
+            let address = CraftNativeMedia.identity(args.first as? String ?? "", options: options)
+            guard !address.isEmpty else {
+                sync = failure("INVALID_ARGUMENT", "media.remove needs a source or cache key")
+                break
+            }
+            DispatchQueue.global(qos: .utility).async {
+                do { complete(requestToken, .success(try CraftNativeMedia.remove(address)), completion) }
+                catch { complete(requestToken, failure("IO_ERROR", "The media copy could not be removed"), completion) }
+            }
+            return
         case ("Media", "prune"):
             let keep = (args.first as? [Any] ?? []).compactMap { value -> String? in
                 if let url = value as? String { return url }
@@ -1001,7 +1020,8 @@ enum CraftNativeActions {
         // On the app's background session (CraftNativeMediaTransfers): it
         // carries on while the app is suspended, and a keep the phone cannot
         // fetch now is answered at once while its transfer waits with iOS.
-        let task = CraftNativeMediaTransfers.shared.start(request, address: address, flight: flight, wifiOnly: wifiOnly)
+        guard let ownership = CraftNativeMedia.ownershipStamp(address, flight: flight) else { return }
+        let task = CraftNativeMediaTransfers.shared.start(request, address: address, flight: flight, ownership: ownership, wifiOnly: wifiOnly)
         cancellationLock.lock()
         // Unless it answered already (a queued transfer, or an instant failure).
         if CraftNativeMedia.isWaiting(address, flight: flight) { fetchTasks[requestToken] = task }

package/dist/ios/templates/CraftNativeFiles.swift

@@ -943,9 +943,40 @@ enum CraftNativeMedia {
     /// Addresses being fetched now, so a second `keep` waits for the first.
     private struct Flight {
         let id: UUID
+        let ownership: CraftNativeMediaOwnership.Stamp
         var waiting: [(Result<Any, CraftNativeActionError>) -> Void]
     }
     private static var inFlight: [String: Flight] = [:]
+    private static var owner: CraftNativeMediaOwnership?
+
+    /// Called under the same lock as cache commits. Keep the journal outside
+    /// the cache directory so clear/prune cannot erase revocation history.
+    private static func ownership() throws -> CraftNativeMediaOwnership {
+        if let owner { return owner }
+        let value = try CraftNativeMediaOwnership(url: root.deletingLastPathComponent().appendingPathComponent("craft-media-ownership.json"))
+        owner = value
+        return value
+    }
+
+    private static func ownerKey(_ address: String) -> String {
+        String(file(for: address).lastPathComponent.prefix(64))
+    }
+
+    /// Remove only this identity's complete and staging files. A failed
+    /// unlink remains observable; its durable tombstone still hides the copy.
+    private static func removeFiles(_ address: String) throws -> Int {
+        let fm = FileManager.default
+        guard fm.fileExists(atPath: root.path) else { return 0 }
+        let prefix = ownerKey(address) + "."
+        var removed = 0
+        var failure: Error?
+        for url in try fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil) where url.lastPathComponent.hasPrefix(prefix) {
+            do { try fm.removeItem(at: url); removed += 1 }
+            catch { failure = error }
+        }
+        if let failure { throw failure }
+        return removed
+    }
 
     /// Where `address`'s copy lives (whether or not it is there yet). The
     /// extension is the address's, because AVPlayer reads the type from it.
@@ -959,8 +990,12 @@ enum CraftNativeMedia {
     /// The copy of `address` on this phone, or nil.
     static func local(_ address: String) -> URL? {
         guard !address.isEmpty else { return nil }
+        lock.lock()
+        defer { lock.unlock() }
+        guard (try? ownership().permitsLocal(ownerKey(address))) == true else { return nil }
         let url = file(for: address)
-        return ((try? url.resourceValues(forKeys: [.fileSizeKey]).fileSize) ?? 0) > 0 ? url : nil
+        let values = try? url.resourceValues(forKeys: [.fileSizeKey, .isRegularFileKey])
+        return values?.isRegularFile == true && (values?.fileSize ?? 0) > 0 ? url : nil
     }
 
     static func describe(_ address: String, _ url: URL) -> [String: Any] {
@@ -971,14 +1006,35 @@ enum CraftNativeMedia {
     /// A new download's identity, or nil after joining an existing download.
     static func begin(_ address: String, _ done: @escaping (Result<Any, CraftNativeActionError>) -> Void) -> UUID? {
         lock.lock()
-        defer { lock.unlock() }
         if inFlight[address] != nil {
             inFlight[address]!.waiting.append(done)
+            lock.unlock()
+            return nil
+        }
+        do {
+            let stamp = try ownership().activate(ownerKey(address)) { _ = try removeFiles(address) }
+            let id = UUID()
+            inFlight[address] = Flight(id: id, ownership: stamp, waiting: [done])
+            lock.unlock()
+            return id
+        } catch {
+            lock.unlock()
+            done(.failure(CraftNativeActionError(code: errorCode(error, fallback: "IO_ERROR"), message: "Media ownership could not be persisted")))
             return nil
         }
-        let id = UUID()
-        inFlight[address] = Flight(id: id, waiting: [done])
-        return id
+    }
+
+    static func ownershipStamp(_ address: String, flight: UUID) -> CraftNativeMediaOwnership.Stamp? {
+        lock.lock()
+        defer { lock.unlock() }
+        guard let current = inFlight[address], current.id == flight else { return nil }
+        return current.ownership
+    }
+
+    static func acceptsTransfer(_ address: String, stamp: CraftNativeMediaOwnership.Stamp) -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        return (try? ownership().accepts(ownerKey(address), stamp: stamp)) == true
     }
 
     /// Whether `flight` is still the download `address`'s keeps wait for.
@@ -997,7 +1053,7 @@ enum CraftNativeMedia {
 
     /// A finished download moved into place (atomically, so a half-written
     /// file is never played), or a refusal with the server's status.
-    static func store(_ address: String, at location: URL, response: HTTPURLResponse, flight: UUID? = nil, stillWanted: (() -> Bool)? = nil) -> Result<Any, CraftNativeActionError> {
+    static func store(_ address: String, at location: URL, response: HTTPURLResponse, flight: UUID? = nil, stamp: CraftNativeMediaOwnership.Stamp? = nil, stillWanted: (() -> Bool)? = nil) -> Result<Any, CraftNativeActionError> {
         guard response.statusCode == 200 else {
             return .success(["ok": false, "url": address, "status": response.statusCode])
         }
@@ -1008,11 +1064,15 @@ enum CraftNativeMedia {
         if let flight, inFlight[address]?.id != flight {
             return .failure(CraftNativeActionError(code: "CANCELLED", message: "The media cache was cleared"))
         }
+        let captured = stamp ?? flight.flatMap { inFlight[address]?.id == $0 ? inFlight[address]?.ownership : nil }
+        guard let captured, (try? ownership().accepts(ownerKey(address), stamp: captured)) == true else {
+            return .failure(CraftNativeActionError(code: "CANCELLED", message: "Media ownership was retired"))
+        }
         // A background transfer from before the cache was cleared (sign-out).
         if let stillWanted, !stillWanted() {
             return .failure(CraftNativeActionError(code: "CANCELLED", message: "The media cache was cleared"))
         }
-        let staging = root.appendingPathComponent(UUID().uuidString + ".part")
+        let staging = root.appendingPathComponent(ownerKey(address) + "." + UUID().uuidString + ".part")
         defer { try? fm.removeItem(at: staging) }
         do {
             // URL resource values can retain a previous size when a retry
@@ -1045,15 +1105,20 @@ enum CraftNativeMedia {
     /// End an account's cache lifetime.
     static func clear() throws -> Int {
         lock.lock()
+        var failure: Error?
+        do { try ownership().clear() }
+        catch { failure = error }
         let waiting = inFlight.values.flatMap { $0.waiting }
         inFlight.removeAll()
         // Under the same lock a background transfer commits under: none
         // started before this lands after it.
         CraftNativeMediaTransfers.shared.cancelAll()
         let fm = FileManager.default
-        let files = (try? fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil)) ?? []
+        var files: [URL] = []
+        do {
+            if fm.fileExists(atPath: root.path) { files = try fm.contentsOfDirectory(at: root, includingPropertiesForKeys: nil) }
+        } catch { failure = error }
         var removed = 0
-        var failure: Error?
         for url in files {
             do { try fm.removeItem(at: url); removed += 1 }
             catch { failure = error }
@@ -1064,6 +1129,24 @@ enum CraftNativeMedia {
         return removed
     }
 
+    /// Revoke one cache identity without removing other authorized media.
+    static func remove(_ address: String) throws -> Int {
+        guard !address.isEmpty else { throw CraftNativeActionError(code: "INVALID_ARGUMENT", message: "media.remove needs a source or cache key") }
+        lock.lock()
+        var failure: Error?
+        do { try ownership().retire(ownerKey(address)) }
+        catch { failure = error }
+        let waiting = inFlight.removeValue(forKey: address)?.waiting ?? []
+        CraftNativeMediaTransfers.shared.cancelRetired(address: address)
+        var removed = 0
+        do { removed = try removeFiles(address) }
+        catch { failure = error }
+        lock.unlock()
+        for done in waiting { done(.failure(CraftNativeActionError(code: "CANCELLED", message: "Media ownership was retired"))) }
+        if let failure { throw failure }
+        return removed
+    }
+
     /// Removes every copy whose address is not in `keep`; answers how many.
     static func prune(keep: [String]) -> Int {
         CraftNativeMediaTransfers.shared.cancel(except: keep + Array(inFlightAddresses()))
@@ -1120,6 +1203,24 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         let generation: Int
     }
 
+    private struct Description: Codable {
+        let address: String
+        let ownership: CraftNativeMediaOwnership.Stamp
+    }
+
+    private static func describe(_ address: String, ownership: CraftNativeMediaOwnership.Stamp) -> String {
+        // No network capability is added to the journal: only the task that
+        // already owns the authorized request carries its cache identity.
+        let data = try! JSONEncoder().encode(Description(address: address, ownership: ownership))
+        return "craft-media-v2:" + data.base64EncodedString()
+    }
+
+    private static func description(_ task: URLSessionTask) -> Description? {
+        guard let text = task.taskDescription, text.hasPrefix("craft-media-v2:"),
+              let data = Data(base64Encoded: String(text.dropFirst("craft-media-v2:".count))) else { return nil }
+        return try? JSONDecoder().decode(Description.self, from: data)
+    }
+
     private let lock = NSLock()
     private var transfers: [Int: Transfer] = [:]
     /// What each finished download came to, until its task completes.
@@ -1143,7 +1244,10 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
             guard let self else { return }
             self.lock.lock()
             for case let task as URLSessionDownloadTask in tasks where task.state == .running || task.state == .suspended {
-                if let address = task.taskDescription, self.transfers[task.taskIdentifier] == nil { self.restored[address] = task }
+                // A pre-upgrade address-only description cannot establish
+                // durable ownership. A new authorized keep can replace it.
+                guard let description = Self.description(task) else { task.cancel(); continue }
+                if self.transfers[task.taskIdentifier] == nil { self.restored[description.address] = task }
             }
             self.lock.unlock()
         }
@@ -1154,11 +1258,12 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
     }
 
     /// Fetches `request` into the copy for `address`, finishing `flight`.
-    func start(_ request: URLRequest, address: String, flight: UUID, wifiOnly: Bool) -> URLSessionTask {
+    func start(_ request: URLRequest, address: String, flight: UUID, ownership: CraftNativeMediaOwnership.Stamp, wifiOnly: Bool) -> URLSessionTask {
         lock.lock()
         let task: URLSessionDownloadTask
         if let earlier = restored.removeValue(forKey: address), earlier.state == .running || earlier.state == .suspended {
-            if earlier.originalRequest?.url == request.url && earlier.originalRequest?.allHTTPHeaderFields == request.allHTTPHeaderFields {
+            if Self.description(earlier)?.ownership == ownership,
+               earlier.originalRequest?.url == request.url && earlier.originalRequest?.allHTTPHeaderFields == request.allHTTPHeaderFields {
                 task = earlier
             }
             else {
@@ -1167,12 +1272,12 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
                 earlier.taskDescription = nil
                 earlier.cancel()
                 task = session.downloadTask(with: request)
-                task.taskDescription = address
+                task.taskDescription = Self.describe(address, ownership: ownership)
             }
         }
         else {
             task = session.downloadTask(with: request)
-            task.taskDescription = address
+            task.taskDescription = Self.describe(address, ownership: ownership)
         }
         transfers[task.taskIdentifier] = Transfer(address: address, flight: flight, wifiOnly: wifiOnly, generation: generation)
         lock.unlock()
@@ -1204,7 +1309,28 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         generation += 1
         restored.removeAll()
         lock.unlock()
-        session.getAllTasks { tasks in tasks.forEach { $0.cancel() } }
+        // The asynchronous enumeration may run after a new authorized keep.
+        // Retire only obsolete stamps, never that new generation's task.
+        session.getAllTasks { tasks in
+            for task in tasks {
+                guard let description = Self.description(task), CraftNativeMedia.acceptsTransfer(description.address, stamp: description.ownership) else {
+                    task.cancel()
+                    continue
+                }
+            }
+        }
+    }
+
+    func cancelRetired(address: String) {
+        lock.lock()
+        restored.removeValue(forKey: address)
+        lock.unlock()
+        session.getAllTasks { tasks in
+            for task in tasks {
+                guard let description = Self.description(task) else { task.cancel(); continue }
+                if description.address == address && !CraftNativeMedia.acceptsTransfer(address, stamp: description.ownership) { task.cancel() }
+            }
+        }
     }
 
     /// Stops the transfers for addresses no longer wanted.
@@ -1214,7 +1340,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         restored = restored.filter { wanted.contains($0.key) }
         lock.unlock()
         session.getAllTasks { tasks in
-            for task in tasks where !wanted.contains(task.taskDescription ?? "") { task.cancel() }
+            for task in tasks where !wanted.contains(Self.description(task)?.address ?? "") { task.cancel() }
         }
     }
 
@@ -1224,7 +1350,11 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         lock.unlock()
         // One left by an earlier launch belongs to the generation this launch began with.
         let started = transfer?.generation ?? 0
-        guard let address = transfer?.address ?? downloadTask.taskDescription else { return }
+        guard let description = Self.description(downloadTask) else {
+            record(downloadTask, .failure(CraftNativeActionError(code: "CANCELLED", message: "The media transfer has no durable ownership")))
+            return
+        }
+        let address = description.address
         guard let http = downloadTask.response as? HTTPURLResponse else {
             record(downloadTask, .failure(CraftNativeActionError(code: "NETWORK_ERROR", message: "media.keep received a response that is not HTTP")))
             return
@@ -1232,7 +1362,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         // The system deletes `location` once this returns: move it now. It
         // lands whether its keep is still waiting or was answered early; only
         // a clear since it started (sign-out) keeps it out.
-        record(downloadTask, CraftNativeMedia.store(address, at: location, response: http, stillWanted: { [weak self] in self?.isCurrent(started) ?? false }))
+        record(downloadTask, CraftNativeMedia.store(address, at: location, response: http, stamp: description.ownership, stillWanted: { [weak self] in self?.isCurrent(started) ?? false }))
     }
 
     /// How many times the cache was cleared in this launch; a transfer started before the last clear does not land.
@@ -1256,7 +1386,7 @@ final class CraftNativeMediaTransfers: NSObject, URLSessionDownloadDelegate {
         lock.lock()
         let transfer = transfers.removeValue(forKey: task.taskIdentifier)
         let result = finished.removeValue(forKey: task.taskIdentifier)
-        if let address = task.taskDescription, restored[address] === task { restored.removeValue(forKey: address) }
+        if let address = Self.description(task)?.address, restored[address] === task { restored.removeValue(forKey: address) }
         lock.unlock()
         guard let transfer, let flight = transfer.flight else { return }
         if let error {

package/dist/ios/templates/CraftNativeMediaOwnership.swift

@@ -0,0 +1,92 @@
+import Foundation
+
+/// Durable ownership of cached media and background transfers. The media
+/// store serializes access to this journal with its file-commit lock.
+final class CraftNativeMediaOwnership {
+    struct Stamp: Codable, Equatable {
+        let epoch: String
+        let revision: String
+    }
+
+    private struct Journal: Codable {
+        var version = 1
+        var epoch = UUID().uuidString
+        var legacyCopiesAllowed = true
+        var revisions: [String: String] = [:]
+        var revoked: Set<String> = []
+        var authorized: Set<String> = []
+    }
+
+    private let url: URL
+    private var journal: Journal
+    private var persistenceFailure: Error?
+
+    init(url: URL) throws {
+        self.url = url
+        if FileManager.default.fileExists(atPath: url.path) {
+            journal = try JSONDecoder().decode(Journal.self, from: Data(contentsOf: url))
+            guard journal.version == 1 else { throw CocoaError(.fileReadCorruptFile) }
+        } else {
+            journal = Journal()
+            try persist(journal)
+        }
+    }
+
+    func permitsLocal(_ identity: String) -> Bool {
+        persistenceFailure == nil && !journal.revoked.contains(identity)
+            && (journal.legacyCopiesAllowed || journal.authorized.contains(identity))
+    }
+
+    func accepts(_ identity: String, stamp: Stamp) -> Bool {
+        permitsLocal(identity) && stamp.epoch == journal.epoch
+            && stamp.revision == (journal.revisions[identity] ?? "")
+    }
+
+    /// A new explicit authorized keep may use this identity again. Old bytes
+    /// must be removed before lifting a tombstone, including after a failed
+    /// unlink. Its old transfer stamp never becomes current again.
+    func activate(_ identity: String, removeRetiredFiles: () throws -> Void) throws -> Stamp {
+        if persistenceFailure != nil { try persist(journal) }
+        if !permitsLocal(identity) {
+            try removeRetiredFiles()
+            var next = journal
+            next.revoked.remove(identity)
+            next.authorized.insert(identity)
+            try persist(next)
+        }
+        return Stamp(epoch: journal.epoch, revision: journal.revisions[identity] ?? "")
+    }
+
+    /// Persist before cancelling or unlinking: a task that outlives this
+    /// process cannot regain ownership on the next launch.
+    func retire(_ identity: String) throws {
+        var next = journal
+        next.revisions[identity] = UUID().uuidString
+        next.revoked.insert(identity)
+        try persist(next)
+    }
+
+    /// Sign-out invalidates all existing stamps and all copies, even if a
+    /// filesystem error prevents unlinking one of them.
+    func clear() throws {
+        var next = Journal()
+        next.legacyCopiesAllowed = false
+        try persist(next)
+    }
+
+    private func persist(_ next: Journal) throws {
+        // A failed journal write is observable and fails closed in this
+        // process. A later retire/clear can retry once storage is writable.
+        journal = next
+        do {
+            try FileManager.default.createDirectory(at: url.deletingLastPathComponent(), withIntermediateDirectories: true)
+            let encoder = JSONEncoder()
+            encoder.outputFormatting = [.sortedKeys]
+            try encoder.encode(next).write(to: url, options: .atomic)
+            persistenceFailure = nil
+        } catch {
+            persistenceFailure = error
+            throw error
+        }
+    }
+}

package/dist/ios/templates/CraftNativeScreen.swift

@@ -9301,7 +9301,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
             field.textColor = color(style["color"]) ?? .label
             field.font = textFont(style, default: .systemFont(ofSize: 16))
             field.textAlignment = textAlignment(style["textAlign"])
-            field.defaultTextAttributes = inputTextAttributes(style, font: field.font ?? .systemFont(ofSize: 16), alignment: field.textAlignment)
+            field.defaultTextAttributes = inputTextAttributes(style, font: field.font ?? .systemFont(ofSize: 16), alignment: field.textAlignment, singleLine: true)
             let desiredKeyboardType = keyboardType(props["keyboardType"])
             if field.keyboardType != desiredKeyboardType { field.keyboardType = desiredKeyboardType }
             let desiredReturnKeyType = returnKeyType(props["returnKeyType"])
@@ -10930,7 +10930,8 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private func inputTextAttributes(
         _ style: [String: Any],
         font: UIFont,
-        alignment: NSTextAlignment
+        alignment: NSTextAlignment,
+        singleLine: Bool = false
     ) -> [NSAttributedString.Key: Any] {
         var attributes: [NSAttributedString.Key: Any] = [
             .foregroundColor: color(style["color"]) ?? .label,
@@ -10940,6 +10941,9 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         // UIKit otherwise resets the field's alignment to natural when these attributes are applied.
         let paragraph = NSMutableParagraphStyle()
         paragraph.alignment = alignment
+        // The default paragraph wraps even inside a UITextField. A long URL
+        // then paints a second line outside the field instead of scrolling.
+        if singleLine { paragraph.lineBreakMode = .byClipping }
         if let lineHeight = number(style["lineHeight"]) {
             paragraph.minimumLineHeight = lineHeight
             paragraph.maximumLineHeight = lineHeight

package/dist/mobile-testing.js

@@ -201,6 +201,7 @@ ${errors}`);
   try {
     if (options.platform === "ios") {
       const files = await Bun.file(join(root, "ios/templates/CraftNativeFiles.swift")).text();
+      const ownership = await Bun.file(join(root, "ios/templates/CraftNativeMediaOwnership.swift")).text();
       const media = files.slice(files.indexOf("enum CraftNativeMedia {"));
       if (!media.startsWith("enum CraftNativeMedia"))
         throw new Error("iOS media implementation missing");
@@ -208,8 +209,10 @@ ${errors}`);
       const isolated = media.replace(/static var root: URL \{[\s\S]*?\n    \}/, 'static var root: URL { CommandLine.arguments.count > 3 ? URL(fileURLWithPath: CommandLine.arguments[3]) : URL(fileURLWithPath: NSTemporaryDirectory()).appendingPathComponent("hq-download-probe-media") }');
       await Bun.write(source, `import Foundation
 import CryptoKit
+import Network
 struct CraftNativeActionError: Error { let code: String;
   let message: String }
+${ownership}
 ${isolated}
 ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
       const iosSDK = (await run(["xcrun", "--sdk", "iphonesimulator", "--show-sdk-path"])).trim();
@@ -229,6 +232,7 @@ ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
         await run(["xcrun", "simctl", "bootstatus", simulator, "-b"]);
       }
       const base = `http://127.0.0.1:${server.port}/ios`;
+      const mediaRoot = join(scratch, "media");
       const image = join(scratch, "cache-pressure.sparseimage");
       const volume = join(scratch, "cache-volume");
       await mkdir(volume);
@@ -240,14 +244,16 @@ ${await Bun.file(join(fixtures, "media-cache.swift.fixture")).text()}`);
       mountedVolume = "";
       print("PASS: iOS native ENOSPC, cache cleanup, progress preservation and video redownload");
       if (!storageOnly) {
-        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "normal"]));
-        const interrupted = await run(["xcrun", "simctl", "spawn", simulator, executable, base, "interrupt"], scratch, true);
+        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "normal", mediaRoot]));
+        for (const phase of ["retire", "retired-recover"])
+          print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, phase, mediaRoot]));
+        const interrupted = await run(["xcrun", "simctl", "spawn", simulator, executable, base, "interrupt", mediaRoot], scratch, true);
         print(interrupted);
         if (!interrupted.includes("KILLING"))
           throw new Error("iOS probe did not reach process-death checkpoint");
         if (counts.get("/ios/restart.mp4") !== 1)
           throw new Error("iOS process did not start interrupted download");
-        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "recover"]));
+        print(await run(["xcrun", "simctl", "spawn", simulator, executable, base, "recover", mediaRoot]));
         if (counts.get("/ios/slow.mp4") !== 1)
           throw new Error("iOS duplicate fetch: keep did not coalesce");
         if (counts.get("/ios/account/slow.mp4") !== 2)
@@ -328,6 +334,9 @@ ${await Bun.file(join(fixtures, "media-cache.kt")).text()}`);
       print("PASS: Android native ENOSPC, cache cleanup, progress preservation and video redownload");
       if (!storageOnly) {
         await probe("normal");
+        await probe("retire");
+        await run([adb, "-s", serial, "shell", "am", "force-stop", packageName]);
+        await probe("retired-recover");
         await probe("interrupt", true);
         if (counts.get("/android/restart.mp4") !== 1)
           throw new Error("Android process did not start interrupted download");

package/dist/testing/media-cache/media-cache.kt

@@ -58,7 +58,7 @@ class DownloadProbe : android.app.Instrumentation() {
                     check(keep(retained), "existing video is kept before storage pressure")
                     val original = CraftNativeMedia.local(targetContext, retained)!!.readBytes()
                     val fresh = "$base/storage.mp4"
-                    val staging = File(CraftNativeMedia.file(targetContext, fresh).absolutePath + ".part")
+                    val staging = CraftNativeMedia.part(targetContext, fresh)
                     val root = staging.parentFile!!
                     check(root.totalSpace in 1..(32L * 1024 * 1024), "storage pressure is confined to a bounded disposable volume")
                     val pressure = File(root, "pressure.mp4")
@@ -90,6 +90,44 @@ class DownloadProbe : android.app.Instrumentation() {
                     CraftNativeMedia.prune(targetContext, emptyList())
                     prefs.edit().clear().commit()
                 }
+                "retire" -> {
+                    val a = "$base/selective-a.mp4"
+                    val b = "$base/selective-b.mp4"
+                    check(keep(a) && keep(b), "two authorized videos are kept")
+                    val oldGeneration = CraftNativeMedia.generation(targetContext)
+                    check(targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).edit().putInt("old-generation", oldGeneration).commit(), "old worker generation is retained for restart verification")
+                    val cacheRoot = CraftNativeMedia.file(targetContext, a).parentFile!!
+                    android.system.Os.chmod(cacheRoot.absolutePath, 365) // 0555: read/search, no unlink
+                    var unlinkFailed = false
+                    try { CraftNativeMedia.remove(targetContext, a) } catch (error: java.io.IOException) { unlinkFailed = true }
+                    finally { android.system.Os.chmod(cacheRoot.absolutePath, 448) } // 0700
+                    check(unlinkFailed, "a real unlink failure is reported")
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "failed unlink hides revoked A and preserves authorized B")
+                    check(CraftNativeMedia.remove(targetContext, a) == 1, "removing A removes only its copy")
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "B stays available after A is revoked")
+                }
+                "retired-recover" -> {
+                    val a = "$base/selective-a.mp4"
+                    val b = "$base/selective-b.mp4"
+                    val oldGeneration = targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).getInt("old-generation", -1)
+                    check(CraftNativeMedia.local(targetContext, a) == null && CraftNativeMedia.local(targetContext, b) != null, "selective revocation survives a fresh Android process")
+                    fun obsoleteCompletion() {
+                        val result = CraftNativeMedia.transfer(targetContext, a, JSONObject(), oldGeneration, 0, ownerRevision = "") { false }
+                        check(result == CraftNativeMedia.Outcome.DONE, "obsolete worker retires without retry or publication")
+                    }
+                    obsoleteCompletion()
+                    check(keep(a), "a new authorized keep can re-grant A")
+                    val fresh = CraftNativeMedia.local(targetContext, a)!!.readBytes()
+                    obsoleteCompletion()
+                    check(CraftNativeMedia.local(targetContext, a)!!.readBytes().contentEquals(fresh), "obsolete worker cannot replace re-granted A")
+                    val decoder = android.media.MediaMetadataRetriever()
+                    try {
+                        decoder.setDataSource(CraftNativeMedia.local(targetContext, b)!!.absolutePath)
+                        check(decoder.getFrameAtTime(1000000) != null, "unrelated B still decodes offline after revocation and re-grant")
+                    } finally { decoder.release() }
+                    CraftNativeMedia.clear(targetContext)
+                    targetContext.getSharedPreferences("media-probe", Context.MODE_PRIVATE).edit().clear().commit()
+                }
                 "interrupt" -> {
                     CraftNativeMedia.prune(targetContext, emptyList())
                     CraftNativeMedia.keep(targetContext, restart, JSONObject(), true) {}
@@ -155,7 +193,8 @@ class DownloadProbe : android.app.Instrumentation() {
                     val settledName = "craft-media:${CraftNativeMedia.digest(settled)}:any"
                     val settledRequest = androidx.work.OneTimeWorkRequestBuilder<SettledMediaAttemptWorker>()
                         .addTag("craft-media").addTag("craft-media:${CraftNativeMedia.digest(settled)}")
-                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}").build()
+                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}")
+                        .addTag("craft-media:identity:${CraftNativeMedia.digest(settled)}:legacy").build()
                     work.enqueueUniqueWork(settledName, androidx.work.ExistingWorkPolicy.KEEP, settledRequest).result.get()
                     val settledDeadline = System.currentTimeMillis() + 10000
                     var settledInfo = work.getWorkInfoById(settledRequest.id).get()!!
@@ -176,7 +215,8 @@ class DownloadProbe : android.app.Instrumentation() {
                         .setInitialDelay(10, java.util.concurrent.TimeUnit.SECONDS)
                         .setInputData(androidx.work.workDataOf("address" to queued, "headers" to "{}", "generation" to CraftNativeMedia.generation(targetContext)))
                         .addTag("craft-media").addTag("craft-media:${CraftNativeMedia.digest(queued)}")
-                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}").build()
+                        .addTag("craft-media:generation:${CraftNativeMedia.generation(targetContext)}")
+                        .addTag("craft-media:identity:${CraftNativeMedia.digest(queued)}:legacy").build()
                     work.enqueueUniqueWork(queuedName, androidx.work.ExistingWorkPolicy.KEEP, queuedRequest).result.get()
                     val beforeJoin = work.getWorkInfoById(queuedRequest.id).get()!!
                     check(beforeJoin.state == androidx.work.WorkInfo.State.ENQUEUED && beforeJoin.runAttemptCount == 0, "the coalescing regression starts with a fresh queued transfer")
@@ -217,6 +257,9 @@ class DownloadProbe : android.app.Instrumentation() {
                     check(currentDone.await(25, java.util.concurrent.TimeUnit.SECONDS) && currentOK, "an obsolete worker cannot cancel the next generation's waiters")
 
                     val inflight = "$base/inflight/slow.mp4"
+                    // This fixture starts the old worker directly rather than through keep.
+                    // Give it the same persisted grant keep records after a clear.
+                    check(targetContext.getSharedPreferences("craft.media", Context.MODE_PRIVATE).edit().putBoolean("authorized:${CraftNativeMedia.digest(inflight)}", true).commit(), "the direct worker starts with an explicit grant")
                     val inflightGeneration = CraftNativeMedia.generation(targetContext)
                     var obsoleteOutcome: CraftNativeMedia.Outcome? = null
                     val obsoleteWriter = Thread { obsoleteOutcome = CraftNativeMedia.transfer(targetContext, inflight, JSONObject(), inflightGeneration, 0) { false } }

package/dist/testing/media-cache/media-cache.swift.fixture

@@ -79,6 +79,48 @@ if phase == "storage" {
     _ = CraftNativeMedia.prune(keep: [])
     exit(0)
 }
+if phase == "retire" || phase == "retired-recover" {
+    let a = base + "/selective-a.mp4"
+    let b = base + "/selective-b.mp4"
+    let saved = CraftNativeMedia.root.deletingLastPathComponent().appendingPathComponent("obsolete-stamp.json")
+    if phase == "retire" {
+        check(keep(a) && keep(b), "two authorized videos are kept")
+        let flight = CraftNativeMedia.begin(a) { _ in }!
+        let stamp = CraftNativeMedia.ownershipStamp(a, flight: flight)!
+        try JSONEncoder().encode(stamp).write(to: saved)
+        try fm.setAttributes([.posixPermissions: 0o555], ofItemAtPath: CraftNativeMedia.root.path)
+        var unlinkFailed = false
+        do { _ = try CraftNativeMedia.remove(a) } catch { unlinkFailed = true }
+        try fm.setAttributes([.posixPermissions: 0o700], ofItemAtPath: CraftNativeMedia.root.path)
+        check(unlinkFailed, "a real unlink failure is reported")
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "failed unlink hides revoked A and preserves authorized B")
+        let removed = try CraftNativeMedia.remove(a)
+        check(removed == 1, "removing A removes only its copy")
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "B stays available after A is revoked")
+    } else {
+        let stamp = try JSONDecoder().decode(CraftNativeMediaOwnership.Stamp.self, from: Data(contentsOf: saved))
+        check(CraftNativeMedia.local(a) == nil && CraftNativeMedia.local(b) != nil, "selective revocation survives a fresh simulator process")
+        func obsoleteCompletion() throws {
+            let payload = CraftNativeMedia.root.deletingLastPathComponent().appendingPathComponent("obsolete-download.mp4")
+            try Data(contentsOf: CraftNativeMedia.local(b)!).write(to: payload)
+            defer { try? fm.removeItem(at: payload) }
+            let response = HTTPURLResponse(url: URL(string: a)!, statusCode: 200, httpVersion: nil, headerFields: nil)!
+            let result = CraftNativeMedia.store(a, at: payload, response: response, stamp: stamp)
+            if case .failure(let error) = result { check(error.code == "CANCELLED", "obsolete transfer cannot publish after process restart") }
+            else { check(false, "obsolete transfer was accepted") }
+        }
+        try obsoleteCompletion()
+        check(keep(a), "a new authorized keep can re-grant A")
+        try obsoleteCompletion()
+        check(CraftNativeMedia.local(a) != nil && CraftNativeMedia.local(b) != nil, "old completion cannot replace re-granted A or remove B")
+        let generator = AVAssetImageGenerator(asset: AVURLAsset(url: CraftNativeMedia.local(b)!))
+        _ = try generator.copyCGImage(at: CMTime(seconds: 1, preferredTimescale: 600), actualTime: nil)
+        check(true, "unrelated B still decodes offline after revocation and re-grant")
+        _ = try CraftNativeMedia.clear()
+        try fm.removeItem(at: saved)
+    }
+    exit(0)
+}
 if phase == "interrupt" {
     _ = CraftNativeMedia.prune(keep: [])
     start(restart) { _ in }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craft-native",
-  "version": "0.0.464",
+  "version": "0.0.467",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",